Authors - Sheromiga Anandajothy, Aathipan Murugaverl, Harinda Fernando, Sarangan Rukminikanthan, Abishathan Thayaparan, Tharaniyawarma Kumaralingam Abstract - Modern malware increasingly employs packing, encryption, polymorphism, staged payload delivery, modular execution, and behavioural evasion techniques to bypass traditional signature-based security systems. While static analysis enables rapid inspection of suspicious binaries, it often performs poorly against heavily obfuscated samples. Conversely, dynamic analysis provides rich runtime evidence but introduces computational overhead, operational latency, and anti-sandbox challenges. This paper presents Mutated Malware Protector, a lightweight hybrid framework for detecting obfuscated and modular malware through static Portable Executable (PE) feature analysis, obfuscation-aware scoring, behavioural risk approximation, modular stage inference, and explainable artificial intelligence (XAI). The framework is designed as a practical analyst-facing pipeline rather than a single classifier. It integrates engineered PE features, anomaly scoring using Isolation Forest, entropy-based obfuscation indicators, a LightGBM static classifier, behavioural approximation, and a modular correlation component that estimates staged roles such as dropper, loader, and payload. Experimental evaluation shows that the prototype achieved 89.00% accuracy, 89.28% precision, 88.81% recall, and 89.04% F1 score. The proposed architecture offers a scalable path toward future integration with full sandbox telemetry and enterprise malware response workflows.
Open Zoom