Legacy Code, Live Risk: Empirical Evidence of Malware Detection Gaps
Source abstract
Abstract
Consistent detection of malicious loaders across varied programming languages and build tools remains a significant cybersecurity challenge. This study empirically measures how compiler and language choices affect the detectability of standard in-memory Windows loaders. We implement functionally equivalent loaders (allocate, copy, protect, execute) in C, C#, Fortran, and COBOL, embedding an identical x64 test payload to isolate behavior. Our results reveal significant detection gaps: loaders compiled in legacy languages (Fortran, COBOL) consistently evade static and dynamic antivirus engines that easily flag their C and C# counterparts. We demonstrate this evasion is not due to behavioral differences, but to compiler-specific static artifacts. These artifacts, such as interleaved zero-bytes in Fortran and fragmented payload-construction logic in COBOL, effectively break common signature matching. These findings indicate that many detection tools are overly sensitive to the static build surface rather than true semantic behavior. We provide actionable guidance favoring behavior-focused analysis, such as tracking API call order and memory protection changes, to address this critical legacy code blind spot.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Security and Verification in Computing · Advanced Malware Detection Techniques · Digital and Cyber Forensics
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Science and Information Engineering, China University of Technology, Taipei 116, Taiwan
Department of Computer Science and Information Engineering, Chung Cheng Institute of Technology, National Defense University, Taoyuan 335009, Taiwan
References (35)
Show source-provided references
1. Samociuk, D. (2023). Antivirus evasion methods in modern operating systems. Appl. Sci., 13.10.3390/app13085083 ↗
2. Direct manipulation: A step beyond programming languages10.1109/MC.1983.1654471 ↗
3. Alkhateeb, E., Ghorbani, A., and Habibi Lashkari, A. (2024). Identifying malware packers through multilayer feature engineering in static analysis. Information, 15.10.3390/info15020102 ↗
4. Shafin, S.S., Karmakar, G., and Mareels, I. (2023). Obfuscated memory malware detection in resource-constrained IoT devices for smart city applications. Sensors, 23.10.3390/s23115348 ↗
5. Akhtar, M.S., and Feng, T. (2022). Malware analysis and detection using machine learning algorithms. Symmetry, 14.10.3390/sym14112304 ↗
6. Tajoddin, A., and Jalili, S. (2018). HM 3 alD: Polymorphic Malware detection using program behavior-aware hidden Markov model. Appl. Sci., 8.10.3390/app8071044 ↗
7. Díaz-Verdejo, J., Muñoz-Calle, J., Estepa Alonso, A., Estepa Alonso, R., and Madinabeitia, G. (2022). On the detection capabilities of signature-based intrusion detection systems in the context of web attacks. Appl. Sci., 12.10.3390/app12020852 ↗
8. Aboaoja, F.A., Zainal, A., Ghaleb, F.A., Al-Rimy, B.A.S., Eisa, T.A.E., and Elnour, A.A.H. (2022). Malware detection issues, challenges, and future directions: A survey. Appl. Sci., 12.10.3390/app12178482 ↗
9. Owoh, N., Adejoh, J., Hosseinzadeh, S., Ashawa, M., Osamor, J., and Qureshi, A. (2024). Malware detection based on api call sequence analysis: A gated recurrent unit–generative adversarial network model approach. Future Internet, 16.10.3390/fi16100369 ↗
10. CTIMD: Cyber threat intelligence enhanced malware detection using API call sequences with parameters10.1016/j.cose.2023.103518 ↗
11. Messahel, W., and Touili, T. (2024, January 19–21). Reachability analysis of concurrent self-modifying code. Proceedings of the International Conference on Engineering of Complex Computer Systems, Limassol, Cyprus.10.1007/978-3-031-66456-4_14 ↗
12. Dora, J.R., and Hluchy, L. (2025, January 27–30). Bypassing Network Activity Monitors using Process Hollowing. Proceedings of the 2025 25th International Conference on Control Systems and Computer Science (CSCS), Bucharest, Romania.10.1109/CSCS66924.2025.00043 ↗
13. Apostolopoulos, T., Koutsokostas, V., Totosis, N., Patsakis, C., and Smaragdakis, G. (2025, January 4–6). Coding Malware in Fancy Programming Languages for Fun and Profit. Proceedings of the Fifteenth ACM Conference on Data and Application Security and Privacy, Pittsburgh, PA, USA.10.1145/3714393.3726506 ↗
14. Chatsomsanga, J., and Benjangkaprasert, C. (2022, January 13–16). Malware Developing Guide: Encryption and Decryption. Proceedings of the 2022 24th International Conference on Advanced Communication Technology (ICACT), PyeongChang, Republic of Korea.10.23919/ICACT53585.2022.9728944 ↗
15. Catalano, C., Specchia, G., and Totaro, N.G. (2023, January 10–13). Enhancing Code Obfuscation Techniques: Exploring the Impact of Artificial Intelligence on Malware Detection. Proceedings of the International Conference on Product-Focused Software Process Improvement, Dornbirn, Austria.10.1007/978-3-031-49269-3_8 ↗
16. Huang, G.C., Chang, K.C., and Lai, T.H. (2025). Evading Antivirus Detection Using Fountain Code-Based Techniques for Executing Shellcodes. Sensors, 25.10.3390/s25020460 ↗
17. Huang, G.C., Chang, K.C., and Lai, T.H. (2024). Chaotic-Based Shellcode Encryption: A New Strategy for Bypassing Antivirus Mechanisms. Symmetry, 16.10.3390/sym16111526 ↗
18. Culic, I., Vochescu, A., and Radovici, A. (2022). A low-latency optimization of a rust-based secure operating system for embedded devices. Sensors, 22.10.3390/s22228700 ↗
19. Malsight: Exploring malicious source code and benign pseudocode for iterative binary malware summarization10.1109/TIFS.2025.3583552 ↗
20. Chatzoglou, E., Karopoulos, G., Kambourakis, G., and Tsiatsikas, Z. (September, January 29). Bypassing antivirus detection: Old-school malware, new tricks. Proceedings of the 18th International Conference on Availability, Reliability and Security, Benevento, Italy.
21. ScriptBlock Smuggling: Uncovering Stealthy Evasion Techniques in PowerShell and. NET Environments10.3390/jcp4020008 ↗
22. Arnold, D., David, C., and Saniie, J. (2022, January 19–21). PowerShell Malware Analysis Using a Novel Malware Rating System. Proceedings of the 2022 IEEE International Conference on Electro Information Technology (eIT), Mankato, MN, USA.10.1109/eIT53891.2022.9813771 ↗
23. Ramamoorthy, J., Varol, C., and Shashidhar, N.K. (2024, January 4–6). APT Warfare: Technical Arsenal and Target Profiles of Linux Malware in Advanced Persistent Threats. Proceedings of the 2024 8th Cyber Security in Networking Conference (CSNet), Paris, France.10.1109/CSNet64211.2024.10851718 ↗
24. State-of-the-Art in Chinese APT Attack and Using Threat Intelligence for Detection. A Survey
25. Komninos, T., and Serpanos, D. (2023). Cyberwarfare in Ukraine: Incidents, Tools and Methods. Hybrid Threats, Cyberterrorism and Cyberwarfare, CRC Press.10.1201/9781003314721-7 ↗
26. Modern programming languages–characteristics and recommendations for instruction
27. Liu, Y., Cai, R., Yin, X., and Liu, S. (2023). An exploit traffic detection method based on reverse shell. Appl. Sci., 13.10.3390/app13127161 ↗
28. Dora, J.R., and Hluchy, L. (2025, January 23–25). Process Injection and Migration Techniques: * Strategies to Bypass Security Software of Network Communication after a Successful Reverse shell. Proceedings of the 2025 IEEE 23rd World Symposium on Applied Machine Intelligence and Informatics (SAMI), Stará Lesná, Slovakia.10.1109/SAMI63904.2025.10883319 ↗
29. Rykaczewski, K., Grelewicz, P., and Stebel, K. (2025). Characteristics of MSFVenom Software for Linux/ARM Architecture and Its Application for Complete Exploit Design. Authorea Prepr., Available online: https://www.techrxiv.org/doi/full/10.36227/techrxiv.176127446.67735988.10.36227/techrxiv.176127446.67735988/v1 ↗
30. Dora, J.R., and Hluchy, L. (2025, January 11–13). Advanced Techniques to Execute a Shellcode in Word Memory. Proceedings of the 2025 IEEE 29th International Conference on Intelligent Engineering Systems (INES), Palermo, Italy.10.1109/INES67149.2025.11078202 ↗
31. Li, Y., Liu, M., Cao, C., and Li, J. (2023). Communication-Traffic-Assisted mining and exploitation of buffer overflow vulnerabilities in ADASs. Future Internet, 15.10.3390/fi15050185 ↗
32. Process Injection Using Return-Oriented Programming10.1109/ACCESS.2025.3592128 ↗
33. Vaidya, R., Kulkarni, P.A., and Jantz, M.R. (2021, January 17–19). Explore capabilities and effectiveness of reverse engineering tools to provide memory safety for binary programs. Proceedings of the International Conference on Information Security Practice and Experience, Nanjing, China.10.1007/978-3-030-93206-0_2 ↗
34. Tian, X., Bik, A., Girkar, M., Grey, P., Saito, H., and Su, E. (2002). Intel® OpenMP C++/Fortran Compiler for Hyper-Threading Technology: Implementation and Performance. Intel Technol. J., 6, Available online: https://openurl.ebsco.com/EPDB%3Agcd%3A12%3A36168172/detailv2?sid=ebsco%3Aplink%3Ascholar&id=ebsco%3Agcd%3A6769164&crl=c&link_origin=scholar.google.com.tw.
35. A Study of Traveling Wave Structures and Numerical Investigation of Two-Dimensional Riemann Problems with Their Stability and Accuracy