Binclean: Sanitizing Disassemblies to Improve Malware Recognition

Abstract

Malware is malicious software that compromises data and computer systems. In 2024, the Internet Crime Complaint Center (IC3) reported $12.47 million in ransomware losses alone, highlighting the escalating severity of cyber threats. Because source code is rarely available, analysts rely on disassembling malware binaries to understand their internal behavior, examining control flow, functions, and embedded routines. To evade detection, malware authors use obfuscation techniques such as packing , which compresses or encrypts executables and restores them at runtime via a decryption stub. Since executables contain both code and data sections, unpacking often produces disassembly with irrelevant functions originating from data regions and decryption routines. These extraneous functions introduce noise and can mislead analysis. In malware lineage studies, similarity scores between versions are used to infer evolutionary relationships; noise functions can distort these scores, resulting in inaccurate lineage graphs and flawed conclusions. We propose a technique to identify noise functions in malware disassembly recovered after unpacking. Our method was evaluated on 13 open-source Windows programs and further tested on executables packed with 12 general-purpose packers. Two machine learning models Support Vector Machine (SVM) and K-Nearest Neighbor (K-NN) were employed for classification. SVM achieved 97.36% accuracy on clean data and 92.76% on packed executables, demonstrating strong generalization. By effectively eliminating disassembly noise, our approach enhances the precision of binary diffing, malware detection, and lineage reconstruction, offering a practical advancement for real-world malware analysis.