Table 2 Embedded capacity and bit rate of function migration methods
From: Code fusion information-hiding algorithm based on PE file function migration
Filename | File length (bytes) | Number of identified functions | Function (average length) | Total hidden capacity (bytes) | Bit rate |
|---|---|---|---|---|---|
write.exe | 5,632 | 4 | 52.75 | 211 | 3.7464 |
notepad.exe | 66,560 | 59 | 220.7966 | 13027 | 19.5718 |
telnet.exe | 85,504 | 111 | 188.4505 | 20918 | 24.4644 |
winmine.exe | 119,808 | 67 | 98.25373 | 6583 | 5.4946 |
qq.exe | 99,744 | 40 | 142.525 | 5701 | 5.7156 |
360sd.exe | 1,697,400 | 2805 | 193.3323 | 542297 | 31.9487 |
thunder.exe | 1,808,176 | 4086 | 132.0952 | 539741 | 29.8500 |