# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 4 Attack Techniques Used by Malicious Code
Spear phishing, unlike traditional phishing and spam email, involves sending emails to a victim that appear to have originated from a person associated with the victim, or another trusted source such as the government or a business. The attack proceeds when the victim opens an attachment or clicks on a corrupted website address. Spear phishing is a serious problem because the malicious emails are made to resemble normal emails, thus causing unsuspecting users to click on links and files [10; 11; 13]. Drive-by download is a method of attacking a vulnerable web site and infecting through simple access of the web site. It is characterized by the difficulty of recognizing hard spreads and infections, and it is one of the most threatening attack techniques. In this technique, malicious code is inserted into the website using an iframe and JavaScript, and it occasionally includes a waypoint to hide the final distribution site. The attacker infects the target system through the downloading and execution of malicious code that includes obfuscated JavaScript files, which are difficult to detect. An attack using iframe attempts to attach an inframe to the main html file, then proceeds as a drive-by download attack; the iframe is hidden by setting the width and height to zero so the user does not see it [11; 12; 13; 26; 28; 29]. A watering hole is a type of drive-by-download attack that is characterized by attacking a specific target. This attack is very dangerous because it attempts to exploit unknown vulnerabilities in general [13; 29]. As described above, the attacker penetrates a victim's system in an automated manner, but they sometimes perform a more sophisticated manual attack. The attacker operates on the basis of information collected in the preliminary investigation step, and they write and use an automated tool or specific commands to propagate the malicious code [13]. There are also IP clocking attacks [12], Layer-1 attacks [12], etc. The infection paths in the penetration step include malicious code infection through visits to internal websites, malicious code infection through regular website visits, email attacks with specific goals inside the target organization, malicious code infection through the media, and management system attacks. Through these paths, the malicious code prepared in the above process is installed on and penetrates the victim's system [13]. In the latency step, the malicious code that is placed on the victim's system in the penetration step is hidden to avoid being detected by the security system. In this step, the malicious code makes use of attack techniques such as rootkit, encryption, memory patch, steganography, code obfuscation, execution compression, and anti-VM (Virtual Machine) [13; 26; 28]. A rootkit hides malicious code so that it cannot be detected by the security system; it mainly tries to block and conceal access by manipulating the legal operations in the user and kernel modes. For example, the malicious code hooks API functions such as IoCompleteRequest() to block access to programs and files, and it hides its own process by changing the process structure (EPROCESS) [13; 26; 28]. Encryption is a technique in which an attacker encrypts a program that has successfully penetrated the target system so that it is not detected by the security system, or encrypts the contents to hide packets that are transmitted to the network. Since the encrypted program cannot execute malicious behaviors until the program has been decrypted, it can remain hidden and go undetected by the security program. The encrypted packets can pass through the security system and be securely transmitted to the victim's system because they cannot be checked until the packets are decrypted. Moreover, malicious actions can be performed, such as specific attacks and information gathering through communication with the outside [13, 28].