I'm studying common malware characteristics, and I'm having a bit of difficulty understanding the design choices the malware authors make. Many of said choices seem to revolve around making life difficult for a human analyst to pick apart the malware, while potentially making the malware very easy for an automated system to flag as "probably malicious." I'm curious to see if anyone can tell me what the rationale is behind such design choices.
For example, some anti-reverse engineering tactics. Yes, they may make it more difficult for the analyst to reverse the malware, but tactics like TLS callbacks could easily be flagged as suspicious, especially since the malware is almost never signed, whereas most legitimate software that uses such techniques for anti-RE purposes is.
Another example would be anti-VM tactics. Most AV emulators time out after a short period. There's no need to detect the emulator. Just do something for a few seconds (other than something obviously delaying, such as calling sleep()), as opposed to doing extremely noisy checks like trying to open a bunch of VMWare and VirtualBox registry keys. The only case where you can't just outlast the VM is when there's a human analyzing the sample, and if a sufficiently motivated human is analyzing a program, they're going to be able to reverse it eventually, so why even bother?
Maybe I'm just not knowledgeable enough in the field of making malware to understand the purpose for all this, but it would seem to me that the kind of systems a malware author would be trying to bypass would mostly be automated systems. For example, antivirus engines or automated sandboxes that AV companies use to analyze new, potentially malicious samples that sort said samples into "definitely not malicious; discard" and "potentially malicious; send for human review" piles. The main goal of the malware author would seem to be keeping those automated systems from flagging the program as suspicious to reduce the chance of the malware ending up in front of a human analyst to begin with, not slightly frustrating the human analyst who will eventually be able to analyze the malware anyway.
I know that some malware authors are just script kiddies, but I'd assume at least some of them put effort into making software development choices. I'd assume they know more than I do about the subject, since they do malware development for a living. But I can't understand some of the design decisions they make. Can anyone explain to me the rationale behind these decisions?