{"id":3957,"date":"2016-11-26T00:07:57","date_gmt":"2016-11-26T00:07:57","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3957"},"modified":"2016-11-26T00:11:32","modified_gmt":"2016-11-26T00:11:32","slug":"3m-samples-random-stats","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2016\/11\/26\/3m-samples-random-stats\/","title":{"rendered":"3M samples &#8211; random stats"},"content":{"rendered":"<p>It&#8217;s been a while since I published some stats on a substantial corpora of samples, so here&#8217;s a quickie &#8211; re-visiting the compilation timestamp.<\/p>\n<p>Three things to note:<\/p>\n<ul>\n<li>these stats are biased (I don&#8217;t have all the malware under the Sun)<\/li>\n<li>many samples in 2015-2016 show traces of compilation tampering so compilation timestamp is no longer reliable<\/li>\n<li>many malware samples are Delphi samples and their timestamps <a href=\"https:\/\/www.hexacorn.com\/blog\/2014\/12\/05\/the-not-so-boring-land-of-borland-executables-part-1\/\">are wrong<\/a><\/li>\n<\/ul>\n<p>Still&#8230; quasi-scientific pictures are always nice to look at \ud83d\ude09<\/p>\n<ul>\n<li>3M samples, excluding non-sensical timestamps (I may investigate that spike in July 2015 one day):<\/li>\n<\/ul>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-3958\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M-300x108.png\" alt=\"3m\" width=\"500\" height=\"180\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M-300x108.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M-768x277.png 768w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M.png 933w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<ul>\n<li>3M samples, compilation time by the day of the month (end of the month = time to wrap it up and procrastinate):<br \/>\n<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_dayOfTheMonth.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-3959\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_dayOfTheMonth-300x188.png\" alt=\"3m_dayofthemonth\" width=\"500\" height=\"313\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_dayOfTheMonth-300x188.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_dayOfTheMonth-80x50.png 80w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_dayOfTheMonth.png 670w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/li>\n<li>3M samples, compilation time by the day of the week (weekends are defo a thing for everyone):<br \/>\n<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_dayOfTheWeek.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-3960 size-full\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_dayOfTheWeek.png\" alt=\"3m_dayoftheweek\" width=\"551\" height=\"296\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_dayOfTheWeek.png 551w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_dayOfTheWeek-300x161.png 300w\" sizes=\"(max-width: 551px) 100vw, 551px\" \/><\/a><\/li>\n<li>3M samples, compilation time by the hour (Europe is a malware cradle, apparently):<br \/>\n<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_hour.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-3961 size-full\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_hour.png\" alt=\"3m_hour\" width=\"480\" height=\"288\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_hour.png 480w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_hour-300x180.png 300w\" sizes=\"(max-width: 480px) 100vw, 480px\" \/><\/a><\/li>\n<li>3M samples, compilation time by the hour:minute (I have no idea what it shows):<br \/>\n<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_hour_minute.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-3962\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_hour_minute_condensed-300x159.png\" alt=\"3m_hour_minute_condensed\" width=\"499\" height=\"264\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_hour_minute_condensed-300x159.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2016\/11\/3M_hour_minute_condensed.png 645w\" sizes=\"(max-width: 499px) 100vw, 499px\" \/><\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>It&#8217;s been a while since I published some stats on a substantial corpora of samples, so here&#8217;s a quickie &#8211; re-visiting the compilation timestamp. Three things to note: these stats are biased (I don&#8217;t have all the malware under the &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2016\/11\/26\/3m-samples-random-stats\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[39,9,40],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3957"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=3957"}],"version-history":[{"count":4,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3957\/revisions"}],"predecessor-version":[{"id":3967,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3957\/revisions\/3967"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=3957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=3957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=3957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}