{"id":22645,"date":"2013-03-06T11:19:17","date_gmt":"2013-03-06T19:19:17","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=22645"},"modified":"2025-06-02T19:33:13","modified_gmt":"2025-06-03T02:33:13","slug":"malware-behaves-oddly-in-automated-analysis-environment","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/","title":{"rendered":"Malware Behaves Oddly in Automated Analysis Environment"},"content":{"rendered":"<p>While testing malware recently, we got some logs from our automated analysis system showing a few samples that are only partially replicated. We have heuristics that predict the behavior of a sample; but if that prediction fails, then the heuristics identify the state of a sample and decide if it is worth sending to our second level of analysis. We took a close look at all the samples that were sent to the second level and found some interesting and strange behavior. We noticed that some samples behave differently when executed by a process that runs in background, without a window, compared with a process that execute samples with a visible window. To demonstrate, let\u2019s take a look at the following example.<\/p>\n<p>We executed the sample manually by double-clicking the executable as well as using the command prompt. Everything worked fine; we can see the running process in Process Explorer.<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/1st.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-22646\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/1st.png\" alt=\"1st\" width=\"643\" height=\"155\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/03\/1st.png 643w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/03\/1st-300x72.png 300w\" sizes=\"auto, (max-width: 643px) 100vw, 643px\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">However, when we ran the same malware sample via a console-based application that started the malware process in suspended mode, it injected a DLL into the malware and terminated itself after resuming the malware process. Although we assume the malware is supposed to do more, it simply terminated without an error.<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/2nd.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-22650\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/2nd.png\" alt=\"2nd\" width=\"827\" height=\"177\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/03\/2nd.png 827w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/03\/2nd-300x64.png 300w\" sizes=\"auto, (max-width: 827px) 100vw, 827px\" \/><\/a><\/p>\n<p>We further investigated the malware sample and suspect that it may need to check its parent process window before doing further activities. This behavior may not be intentional and seems to be an accidental event.<\/p>\n<p>We ran the same sample again in a console-based application, but this time we made some minor modifications, such as adding sleep for couple of seconds after the ResumeThread. The malware sample ran accordingly:<\/p>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/3rd.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-22651\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/3rd.png\" alt=\"3rd\" width=\"829\" height=\"204\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/03\/3rd.png 829w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/03\/3rd-300x73.png 300w\" sizes=\"auto, (max-width: 829px) 100vw, 829px\" \/><\/a><\/p>\n<p>Looking at the code, we saw a deviation in execution flow when the malware sample was executed by a process with a window or without a window.<\/p>\n<p>The following code is responsible for the deviation. In each case, the sample used different arguments to CallWindowProcA API.<\/p>\n<h2>Loop:<\/h2>\n<p>RETURN ADDRESS: 0x00431962 CALL FUNCTION: USER32!CallNextHookEx<br \/>\nRETURN ADDRESS: 0x004391e7 CALL FUNCTION: KERNEL32!EnterCriticalSection<br \/>\nRETURN ADDRESS: 0x004391fb CALL FUNCTION: KERNEL32!TlsGetValue<br \/>\nRETURN ADDRESS: 0x00439211 CALL FUNCTION: KERNEL32!LeaveCriticalSection<br \/>\nRETURN ADDRESS: 0x004391e7 CALL FUNCTION: KERNEL32!EnterCriticalSection<br \/>\nRETURN ADDRESS: 0x004391fb CALL FUNCTION: KERNEL32!TlsGetValue<br \/>\nRETURN ADDRESS: 0x00439211 CALL FUNCTION: KERNEL32!LeaveCriticalSection<br \/>\nRETURN ADDRESS: 0x004391e7 CALL FUNCTION: KERNEL32!EnterCriticalSection<br \/>\nRETURN ADDRESS: 0x004391fb CALL FUNCTION: KERNEL32!TlsGetValue<br \/>\nRETURN ADDRESS: 0x00439211 CALL FUNCTION: KERNEL32!LeaveCriticalSection<br \/>\nRETURN ADDRESS: 0x0043a215 CALL FUNCTION: KERNEL32!EnterCriticalSection<br \/>\nRETURN ADDRESS: 0x0043a22b CALL FUNCTION: KERNEL32!InitializeCriticalSection<br \/>\nRETURN ADDRESS: 0x0043a238 CALL FUNCTION: KERNEL32!LeaveCriticalSection<br \/>\nRETURN ADDRESS: 0x0043a244 CALL FUNCTION: KERNEL32!EnterCriticalSection<br \/>\nRETURN ADDRESS: 0x0043a26c CALL FUNCTION: KERNEL32!LeaveCriticalSection<br \/>\n<strong>RETURN ADDRESS: 0x0042e009 CALL FUNCTION: USER32!CallWindowProcA<\/strong><\/p>\n<p>The message argument to CallWindowProcA when the sample was executed by a background process (without a window):<\/p>\n<p>0012F088 00000081 |Message = WM_NCCREATE<br \/>\n0012F0D4 00000083 |Message = WM_NCCALCSIZE<br \/>\n0012F088 00000001 |Message = WM_CREATE<br \/>\n0012F0E0 00000005 |Message = WM_SIZE<br \/>\n0012F0E0 00000003 |Message = WM_MOVE<br \/>\n0012F548 00000030 |Message = WM_SETFONT<br \/>\n<strong>0012EE98 00000002 |Message = WM_DESTROY<\/strong><br \/>\n<strong>0012EE98 00000082 |Message = WM_NCDESTROY<\/strong><\/p>\n<p>After the foregoing, the sample process terminated itself.<\/p>\n<p>The message argument to CallWindowProcA when the sample was executed by a process with a visible window:<\/p>\n<p>0012F088 00000081 |Message = WM_NCCREATE<br \/>\n0012F0D4 00000083 |Message = WM_NCCALCSIZE<br \/>\n0012F088 00000001 |Message = WM_CREATE<br \/>\n0012F0E0 00000005 |Message = WM_SIZE<br \/>\n0012F0E0 00000003 |Message = WM_MOVE<br \/>\n0012F548 00000030 |Message = WM_SETFONT<br \/>\n<strong>0012EE98 00000055 |Message = WM_NOTIFYFORMAT<\/strong><br \/>\n<strong>0012EE98 00000129 |Message = WM_QUERYUISTATE<\/strong><\/p>\n<p>This sample runs nicely, without any problems.<\/p>\n<p>We have not seen this type of behavior in any medium- or high-severity malware. The samples we analyzed showing this behavior are mostly installers for adware or spyware.<\/p>\n<p>&nbsp;<\/p>\n<p>I thank my colleagues Benjamin Cruz and Vikas Taneja for\u00a0their advice and assistance.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>While testing malware recently, we got some logs from our automated analysis system showing a few samples that are only&#8230;<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[],"coauthors":[3973],"class_list":["post-22645","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Malware Behaves Oddly in Automated Analysis Environment | McAfee Blog<\/title>\n<meta name=\"description\" content=\"While testing malware recently, we got some logs from our automated analysis system showing a few samples that are only partially replicated. We have\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Malware Behaves Oddly in Automated Analysis Environment | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"While testing malware recently, we got some logs from our automated analysis system showing a few samples that are only partially replicated. We have\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2013-03-06T19:19:17+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-03T02:33:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/03\/1st.png\" \/>\n\t<meta property=\"og:image:width\" content=\"643\" \/>\n\t<meta property=\"og:image:height\" content=\"155\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"Malware Behaves Oddly in Automated Analysis Environment\",\"datePublished\":\"2013-03-06T19:19:17+00:00\",\"dateModified\":\"2025-06-03T02:33:13+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/\"},\"wordCount\":615,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/1st.png\",\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/\",\"name\":\"Malware Behaves Oddly in Automated Analysis Environment | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/1st.png\",\"datePublished\":\"2013-03-06T19:19:17+00:00\",\"dateModified\":\"2025-06-03T02:33:13+00:00\",\"description\":\"While testing malware recently, we got some logs from our automated analysis system showing a few samples that are only partially replicated. We have\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/1st.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/1st.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Malware Behaves Oddly in Automated Analysis Environment\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Malware Behaves Oddly in Automated Analysis Environment | McAfee Blog","description":"While testing malware recently, we got some logs from our automated analysis system showing a few samples that are only partially replicated. We have","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Malware Behaves Oddly in Automated Analysis Environment | McAfee Blog","og_description":"While testing malware recently, we got some logs from our automated analysis system showing a few samples that are only partially replicated. We have","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2013-03-06T19:19:17+00:00","article_modified_time":"2025-06-03T02:33:13+00:00","og_image":[{"width":643,"height":155,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2013\/03\/1st.png","type":"image\/png"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"Malware Behaves Oddly in Automated Analysis Environment","datePublished":"2013-03-06T19:19:17+00:00","dateModified":"2025-06-03T02:33:13+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/"},"wordCount":615,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/1st.png","articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/","name":"Malware Behaves Oddly in Automated Analysis Environment | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/1st.png","datePublished":"2013-03-06T19:19:17+00:00","dateModified":"2025-06-03T02:33:13+00:00","description":"While testing malware recently, we got some logs from our automated analysis system showing a few samples that are only partially replicated. We have","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/1st.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/03\/1st.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/malware-behaves-oddly-in-automated-analysis-environment\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Malware Behaves Oddly in Automated Analysis Environment"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/22645","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=22645"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/22645\/revisions"}],"predecessor-version":[{"id":214936,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/22645\/revisions\/214936"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=22645"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=22645"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=22645"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=22645"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}