Analysis and development of polyglot files

Polyglot files, capable of simultaneously complying with the specifications of multiple formats, are an advanced evasion technique commonly used to hide malware in seemingly legitimate files. This project examines their practical viability and use in real-world cyberattacks, as well as the weaknesse...

Descripción completa

Detalles Bibliográficos
Autor: Gonzalez Valdes, Paul
Tipo de recurso: tesis de maestría
Fecha de publicación:2025
País:España
Institución:Universitat Politècnica de Catalunya (UPC)
Repositorio:UPCommons. Portal del coneixement obert de la UPC
Idioma:inglés
OAI Identifier:oai:upcommons.upc.edu:2117/451931
Acceso en línea:https://hdl.handle.net/2117/451931
Access Level:acceso abierto
Palabra clave:Malware (Computer software)
Cybersecurity
Malware
Polyglot
Programari maliciós
Àrees temàtiques de la UPC::Informàtica::Seguretat informàtica
id ES_45b50df276dff646aa5ecee01ac9cf68
oai_identifier_str oai:upcommons.upc.edu:2117/451931
network_acronym_str ES
network_name_str España
repository_id_str
spelling Analysis and development of polyglot filesAnalysis and Development of Polyglot FilesGonzalez Valdes, PaulMalware (Computer software)CybersecurityMalwarePolyglotProgramari maliciósÀrees temàtiques de la UPC::Informàtica::Seguretat informàticaPolyglot files, capable of simultaneously complying with the specifications of multiple formats, are an advanced evasion technique commonly used to hide malware in seemingly legitimate files. This project examines their practical viability and use in real-world cyberattacks, as well as the weaknesses of various formats that allow malicious code to be inserted by exploiting headers, end of files, and internal fields such as comment spaces. The cases studied confirm that polyglots have already been used in advanced campaigns, such as the Pegasus spyware, and highlight their role in the initial delivery of malware within more complex attack chains. Tests show that while signature-based antivirus software can detect some polyglots, others can evade antivirus engines and sandboxes, revealing significant gaps in current detection systems. In conclusion, polyglot files are a real and effective threat, especially when combined with advanced evasion techniques. Detecting them requires a more detailed analysis of file structures and new defensive strategies to counter increasingly stealthy and intelligent attack tactics.Universitat Politècnica de CatalunyaMorancho Llena, Enrique20252025-07-1020262026-01-28master thesishttp://purl.org/coar/resource_type/c_bdccNAhttp://purl.org/coar/version/c_be7fb7dd8ff6fe43info:eu-repo/semantics/masterThesisapplication/pdfhttps://hdl.handle.net/2117/451931reponame:UPCommons. Portal del coneixement obert de la UPCinstname:Universitat Politècnica de Catalunya (UPC)Inglésengopen accesshttp://purl.org/coar/access_right/c_abf2info:eu-repo/semantics/openAccessoai:upcommons.upc.edu:2117/4519312026-05-27T15:37:01Z
dc.title.none.fl_str_mv Analysis and development of polyglot files
Analysis and Development of Polyglot Files
title Analysis and development of polyglot files
spellingShingle Analysis and development of polyglot files
Gonzalez Valdes, Paul
Malware (Computer software)
Cybersecurity
Malware
Polyglot
Programari maliciós
Àrees temàtiques de la UPC::Informàtica::Seguretat informàtica
title_short Analysis and development of polyglot files
title_full Analysis and development of polyglot files
title_fullStr Analysis and development of polyglot files
title_full_unstemmed Analysis and development of polyglot files
title_sort Analysis and development of polyglot files
dc.creator.none.fl_str_mv Gonzalez Valdes, Paul
author Gonzalez Valdes, Paul
author_facet Gonzalez Valdes, Paul
author_role author
dc.contributor.none.fl_str_mv Morancho Llena, Enrique
dc.subject.none.fl_str_mv Malware (Computer software)
Cybersecurity
Malware
Polyglot
Programari maliciós
Àrees temàtiques de la UPC::Informàtica::Seguretat informàtica
topic Malware (Computer software)
Cybersecurity
Malware
Polyglot
Programari maliciós
Àrees temàtiques de la UPC::Informàtica::Seguretat informàtica
description Polyglot files, capable of simultaneously complying with the specifications of multiple formats, are an advanced evasion technique commonly used to hide malware in seemingly legitimate files. This project examines their practical viability and use in real-world cyberattacks, as well as the weaknesses of various formats that allow malicious code to be inserted by exploiting headers, end of files, and internal fields such as comment spaces. The cases studied confirm that polyglots have already been used in advanced campaigns, such as the Pegasus spyware, and highlight their role in the initial delivery of malware within more complex attack chains. Tests show that while signature-based antivirus software can detect some polyglots, others can evade antivirus engines and sandboxes, revealing significant gaps in current detection systems. In conclusion, polyglot files are a real and effective threat, especially when combined with advanced evasion techniques. Detecting them requires a more detailed analysis of file structures and new defensive strategies to counter increasingly stealthy and intelligent attack tactics.
publishDate 2025
dc.date.none.fl_str_mv 2025
2025-07-10
2026
2026-01-28
dc.type.none.fl_str_mv master thesis
http://purl.org/coar/resource_type/c_bdcc
NA
http://purl.org/coar/version/c_be7fb7dd8ff6fe43
dc.type.openaire.fl_str_mv info:eu-repo/semantics/masterThesis
format masterThesis
dc.identifier.none.fl_str_mv https://hdl.handle.net/2117/451931
url https://hdl.handle.net/2117/451931
dc.language.none.fl_str_mv Inglés
eng
language_invalid_str_mv Inglés
language eng
dc.rights.none.fl_str_mv open access
http://purl.org/coar/access_right/c_abf2
dc.rights.openaire.fl_str_mv info:eu-repo/semantics/openAccess
rights_invalid_str_mv open access
http://purl.org/coar/access_right/c_abf2
eu_rights_str_mv openAccess
dc.format.none.fl_str_mv application/pdf
dc.publisher.none.fl_str_mv Universitat Politècnica de Catalunya
publisher.none.fl_str_mv Universitat Politècnica de Catalunya
dc.source.none.fl_str_mv reponame:UPCommons. Portal del coneixement obert de la UPC
instname:Universitat Politècnica de Catalunya (UPC)
instname_str Universitat Politècnica de Catalunya (UPC)
reponame_str UPCommons. Portal del coneixement obert de la UPC
collection UPCommons. Portal del coneixement obert de la UPC
repository.name.fl_str_mv
repository.mail.fl_str_mv
_version_ 1869407179357814784
score 15,81155

Similares en LA Referencia