Anti-debugging: when malware knows it is watched

To slow analysts, malware detects the analysis environment and, if found, behaves benignly or exits.

The techniques

API: IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess.

PEB: reads the BeingDebugged flag directly in the Process Environment Block.

Timing: rdtsc measures delays: under a debugger the time between two instructions explodes.

Anti-VM/sandbox: looks for artifacts (VMware drivers, low RAM, idle mouse, few processes).

mov eax, fs:[30h]   ; PEB
movzx eax, byte [eax+2]  ; BeingDebugged

Analyst countermeasures

Plugins that hide the debugger (ScyllaHide), patching the checks, more realistic sandboxes, static analysis when dynamic is hostile. It is a constant race between evasion and environment transparency.