Automatic unpacking of executables

Patent metadata

Field	Value
Publication number	US-10691791-B2
Application number	US-201715636905-A
Country	US
Kind code	B2
Filing date	Jun 29, 2017
Priority date	Jun 29, 2017
Publication date	Jun 23, 2020
Grant date	Jun 23, 2020

Abstract

Provided are methods and systems for unpacking and analyzing malware for purposes of identification and investigation. A malicious executable or an application containing malicious code is executed in sandboxed memory to unpack the executable. The memory is then dumped to disk and one or more post-processing operations are performed to generate a new version of the executable, including identifying an initial entry point of the executable, recreating the relocation table, and recreating the import address table, export table, and other tables of the executable. Various types of analyses, such as static analyses, which could not be performed on the malicious executable, are able to be performed on the new version of the executable.

First claim

What is claimed is:

1. A method, comprising:
executing a malicious executable to create an unpacked version of the malicious executable in a physical memory;
dumping at least a portion of the physical memory, containing the unpacked version of the malicious executable, to a storage device;
determining an initial entry point for the malicious executable, wherein the initial entry point does not point to an unpacking function for the malicious executable; and
performing one or more post-processing operations to generate a new version of the malicious executable, wherein the new version of the malicious executable includes the initial entry point.

2. The method of claim 1 , wherein the performing the one or more post-processing operations includes:
creating the new version of the malicious executable from a memory image of the unpacked version of the malicious executable.

3. The method of claim 1 , wherein the performing the one or more post-processing operations includes one or more of:
recreating a relocation table of the malicious executable;
recreating an import address table of the malicious executable; and
recreating an export table of the malicious executable.

4. The method of claim 1 , wherein the determining the initial entry point for the malicious executable includes:
determining the unpacking function of the malicious executable; and
identifying the initial entry point for the malicious executable based on a pointer at the end of the unpacking function.

5. The method of claim 4 , wherein the determining the unpacking function of the malicious executable includes:
comparing the malicious executable to the unpacked version of the malicious executable; and
identifying, based on the comparing, a portion of code present in both the malicious executable and the unpacked version of the malicious executable.

6. The method of claim 1 , wherein the dumping at least a portion of the physical memory to the storage device includes:
creating a first memory dump of the physical memory containing the unpacked version of the malicious executable to the storage device;
determining whether any portions of the malicious executable remains packed;
responsive to determining that a first portion of the malicious executable remains packed, unpacking the first portion of the malicious executable to the physical memory; and
creating a second memory dump of the physical memory containing the unpacked first portion of the malicious executable to the storage device.

7. The method of claim 1 , further comprising:
subsequent to unpacking the malicious executable, determining that the unpacking function of the malicious executable is present in the physical memory; and
determining, based on the presence of the unpacking function in the physical memory, that a portion of the malicious executable remains packed.

8. A system, comprising:
one or more processors; and
one or more non-transitory, computer-readable memories coupled to the one or more processors, the one or more memories storing machine-readable instructions that, when executed by the one or more processors, cause the system to perform operations comprising:
unpacking a malicious program file by executing the malicious program file in a first portion of a memory device;
dumping the first portion of the memory device containing the unpacked malicious program file to a second portion of the memory device;
identifying an initial entry point of the malicious program file, wherein the initial entry point does not point to an unpacking function for the malicious program file; and
creating a new version of the malicious program file from a memory image of the unpacked malicious program file, the new version of the malicious program file including the initial entry point.

9. The system of claim 8 , wherein the one or more memories further store machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
identifying the initial entry point of the malicious program file using one or more heuristics.

10. The system of claim 8 , wherein the one or more memories further store machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
determining the unpacking function of the malicious program file; and
identifying the initial entry point of the malicious program file based on a pointer at the end of the unpacking function.

11. The system of claim 8 , wherein the one or more memories further store machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
determining an expected location of the initial entry point in the first portion of the memory device;
identifying candidate initial entry points based on the expected location of the initial entry point; and
selecting one of the candidate initial entry points as the initial entry point of the malicious program file based on an outcome of executing an application corresponding to the one of the candidate initial entry points.

12. The system of claim 11 , wherein the expected location of the initial entry point in the first portion of the memory device is determined based on one or more statistics.

13. The system of claim 11 , wherein the one or more memories further store machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
identifying neighboring addresses of the expected location of the initial entry point in the first portion of the memory device; and
selecting the neighboring addresses as the candidate initial entry points.

14. The system of claim 8 , wherein the one or more memories further store machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform one or more of the following:
recreating a relocation table of the malicious program file;
recreating an import address table of the malicious program file; and
recreating an export table of the malicious program file.

15. A non-transitory, computer-readable medium having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
executing a packed version of a malicious file to create an unpacked version of the malicious file in a physical memory;
dumping at least a portion of the physical memory containing the unpacked version of the malicious file to a storage device;
identifying an unpacking function of the malicious file;
determining an initial entry point for the malicious file, wherein the initial entry point does not point to the unpacking function of the malicious file;
performing one or more post-processing operations based on the unpacking function; and
creating a new version of the malicious file based on the one or more post-processing operations, wherein the new version of the malicious file includes the initial entry point.

16. The non-transitory, computer-readable medium of claim 15 , wherein the determining the initial entry point of the malicious file is based on a pointer at the end of the unpacking function.

17. The non-transitory, computer-readable medium of claim 15 , wherein the determining the initial entry point of the malicious file is based on a jump or call instruction at the end of the unpacking function.

18. The non-transitory, compute

Assignees

• Paypal Inc

Inventors

• Boutnaru Shlomi

Classifications

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title