Segregating executable files exhibiting network activity

Patent metadata

Field	Value
Publication number	US-10083300-B2
Application number	US-201315039779-A
Country	US
Kind code	B2
Filing date	Dec 27, 2013
Priority date	Dec 27, 2013
Publication date	Sep 25, 2018
Grant date	Sep 25, 2018

Abstract

An executable file is loaded into memory. The executable file is analyzed to determine whether one or more dynamically linked libraries are referenced in an import table of the file. It can then be determined whether one or more dynamically linked libraries is adapted to contact a network.

First claim

What is claimed is:

1. An apparatus comprising:
one or more processing elements; and
a memory, coupled to the one or more processing elements;
a dynamically linked library (DLL) analyzer loadable into the memory, comprising instructions that when executed cause the one or more processing elements to:
determine whether one or more DLLs used by an executable file are adapted to perform network activity;
scan an import descriptor data structure module of the executable file for a reference to a dynamically linked library known to perform network activity;

an executable file analyzer loadable into the memory, comprising instructions that when executed cause the one or more processing elements to:
determine whether the executable file is packed or unpacked;
enumerate the executable file responsive to a determination that the executable file is unpacked;
detect use of one or more DLLs responsive to a determination that the executable file is packed;
invoke the DLL analyzer to process the executable file, responsive to detecting use of one or more executable DLLs; and
perform malware analysis responsive to the determination by the DLL analyzer that the one or more DLLs are adapted to perform network activity.

2. The apparatus of claim 1 , wherein the DLL analyzer further comprises instructions that when executed cause the one or more processing elements to:
identify one or more dynamically linked libraries adapted to perform network activity referenced by the executable file; and
determine whether the one or more dynamically linked libraries perform network activity.

3. The apparatus of claim 1 , wherein the DLL analyzer further comprises instructions that when executed cause the one or more processing elements to:
hook processing of the executable file responsive to determining at least one dynamically linked library adapted to perform network activity is used by the executable file.

4. The apparatus of claim 1 , wherein the memory further comprises instructions to cause the one or more processing elements to:
allow execution of the executable file responsive to determining no dynamically linked library adapted to perform network activity is used by the executable file.

5. The apparatus of claim 4 , wherein the DLL analyzer further comprises instructions that when executed cause the one or more processing elements to:
hook execution of the executable file responsive to identifying network activity by a dynamically linked library.

6. The apparatus of claim 1 , wherein the executable file comprises a portable executable file.

7. A non-transitory computer readable storage medium comprising computer readable code comprising:
a dynamically linked library (DLL) analyzer, comprising instructions that when executed cause the one or more processing elements to:
determine whether one or more DLLs used by an executable file are adapted to perform network activity;
scan an import descriptor data structure module of the executable file for a reference to a dynamically linked library known to perform network activity;

an executable file analyzer, comprising instructions that when executed cause the one or more processing elements to:
determine whether the executable file is packed or unpacked;
enumerate the executable file responsive to a determination that the executable file is unpacked;
detect use of one or more DLLs responsive to a determination that the executable file is packed;
invoke the DLL analyzer to process the executable file, responsive to detecting use of one or more executable DLLs; and
perform malware analysis responsive to the determination by the DLL analyzer that the one or more DLLs are adapted to perform network activity.

8. The non-transitory computer readable medium of claim 7 , wherein the DLL analyzer further comprises instructions that when executed cause the one or more processing elements to:
identify one or more dynamically linked libraries adapted to perform network activity referenced by the executable file; and
determine whether the one or more dynamically linked libraries perform network activity.

9. The non-transitory computer readable medium of claim 7 , wherein the DLL analyzer further comprises instructions that when executed cause the one or more processing elements to:
hook processing of the executable file responsive to determining at least one dynamically linked library adapted to perform network activity is used by the executable file.

10. The non-transitory computer readable medium of claim 7 , further comprising instructions to cause the one or more processing elements to:
allow execution of the executable file responsive to determining no dynamically linked library adapted to perform network activity is used by the executable file.

11. The non-transitory computer readable medium of claim 10 , wherein the DLL analyzer further comprises instructions that when executed cause the one or more processing elements to:
hook execution of the executable file responsive to identifying network activity by a dynamically linked library.

12. The non-transitory computer readable medium of claim 7 , wherein the executable file comprises a portable executable file.

13. A method comprising:
determining whether one or more dynamically linked libraries (DLLs) used by an executable file are adapted to perform network activity;
scanning an import descriptor data structure module of the executable file for a reference to a dynamically linked library known to perform network activity;
determining whether the executable file is packed or unpacked;
enumerating the executable file responsive to a determination that the executable file is unpacked;
detecting use of one or more DLLs responsive to a determination that the executable file is packed;
invoking a DLL analyzer to process the executable file, responsive to detecting use of one or more executable DLLs; and
performing malware analysis responsive to the determination by the DLL analyzer that the one or more DLLs are adapted to perform network activity.

14. The method of claim 13 , further comprising:
identifying one or more dynamically linked libraries adapted to perform network activity referenced by the executable file; and
determining whether the one or more dynamically linked libraries perform network activity.

15. The method of claim 13 , further comprising:
hooking processing of the executable file responsive to determining at least one dynamically linked library adapted to perform network activity is used by the executable file.

16. The method of claim 13 , further comprising:
allowing execution of the executable file responsive to determining no dynamically linked library adapted to perform network activity is used by the executable file.

17. The method of claim 16 , further comprising:
hooking execution of the executable file responsive to identifying network activity by a dynamically linked library.

18. The method of claim 13 , wherein the executable file comprises a portable executable file.

Assignees

• Mcafee Inc
• Mcafee Llc

Inventors

• Thakar Neeraj
• Malik Amit

Classifications

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/44

  Program or device authentication · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title