Build-Hygiene-Based Evasion of Static ML Malware Classifiers and Its Limits

Experimental design. A fully crossed study of 10 loader samples × 2 build configurations × 3 payload types (6 B marker, 489 B Metasploit Meterpreter stager, 35 MB Sliver C2 implant), with the loader design space decomposed onto two orthogonal axes (payload delivery method × API resolution method). Main findings. A clean-build treatment (dynamic CRT, /Os, /RELEASE, /Brepro, /OPT:REF/ICF, embedded manifest, embedded version info) flips the three-model EMBER2024 vote from malicious to benign in 10/10 samples, reducing the mean score from 0.96 to 0.10 (Welch t ≈ 60, p < 10⁻¹⁵) — a safety margin of roughly 0.4 below the 0.5 threshold. External-load loaders exhibit design-level bit-invariance: across 6 samples × 2 builds × 2 real payloads (24 configurations), SHA-256 comparison yields 24/24 byte-identical matches, so evasion is preserved under any payload, including a 35 MB live Sliver C2 implant. Resource-embedding loaders retain evasion with a 489 B stager but cross the decision threshold under a 35 MB payload. The logit shift scales log-linearly with embedded payload size, with piecewise slopes of approximately 0.38 and 1.31 logits per decade and a coarse threshold-crossing estimate near ~1 MB. SHAP decomposition splits the 12 EMBER feature categories into two tiers: byte-statistics categories (ByteHistogram, ByteEntropyHistogram, StringExtractor) respond monotonically and near-linearly to payload size, while structural-metadata categories (ImportsInfo, DataDirectories) respond non-monotonically. About 2.5× of the clean-build effect is attributable to StringExtractor alone. Taken together, evasion of EMBER2024 partitions into three distinct operational regimes — external-load + clean, small-embed (< 1 KB) + clean, and large-embed (> 10 MB) — each with a different evasion profile and a different defender response.