Steganalysis of Hydan

Abstract. Hydan is a steganographic tool which can be used to hide any kind of information inside executable files. In this work, we present an efficient distin-guisher for it: We have developed a system that is able to detect executable files with embedded information through Hydan. Our system uses statistical analysis of instruction set distribution to distinguish between files with no hidden informa-tion and files that have been modified with Hydan. We have tested our algorithm against a mix of clean and stego-executable files. The proposed distinguisher is able to tell apart these files with a 0 ratio of false positives and negatives, thus detecting all files with hidden information through Hydan.