System, apparatus and method for conducting on-the-fly decryption of encrypted objects for malware detection

Patent metadata

Field	Value
Publication number	US-9560059-B1
Application number	US-201514942327-A
Country	US
Kind code	B1
Filing date	Nov 16, 2015
Priority date	Nov 21, 2013
Publication date	Jan 31, 2017
Grant date	Jan 31, 2017

Abstract

A decryption scheme for recover of a decrypted object without a cryptographic key is described. First, logical operation(s) are conducted on data associated with a first data string expected at a first location within an object having the predetermined format and data within the encrypted object at the first location to recover data associated with a portion of a cryptographic key from the encrypted object. Thereafter, logical operation(s) are conducted on that data and a first portion of the encrypted object at a second location to produce a result. Responsive to the result including data associated with the plaintext version of the second data string, logical operation(s) are conducted on a second portion of the encrypted object and the data associated with the plaintext version of the second data string to recover data associated with the cryptographic key. Thereafter, the encrypted object may be decrypted using the cryptographic key.

First claim

The invention claimed is:

1. A computerized method for decrypting an encrypted object having a predetermined format that is received by an electronic device, the method comprising:
performing, by a processor, one or more logical operations at least on (i) data associated with a first data string expected at a first location within the encrypted object having the predetermined format and (ii) data within the encrypted object at the first location to recover data associated with a portion of a cryptographic key from the encrypted object;
conducting, by the processor, one or more logical operations at least on (i) the data associated with the portion of the cryptographic key and (ii) a first portion of the encrypted object at a second location within the encrypted object to produce a result, wherein the second location being different than the first location and the result includes a portion of data associated with a plaintext version of a second data string that is expected at the second location;
responsive to the result including data associated with the plaintext version of the second data string, conducting one or more logical operations by the processor at least on (i) a second portion of the encrypted object and (ii) the data associated with the plaintext version of the second data string expected at the second location to recover data associated with the cryptographic key, wherein the recovered data associated with the cryptographic key includes the data associated with the portion of the cryptographic key; and
decrypting, by the processor, the encrypted object using the cryptographic key to produce a decrypted object.

2. The computerized method of claim 1 , wherein the recovered data associated with the cryptographic key is the cryptographic key and the data associated with the portion of the cryptographic key is a portion of the cryptographic key.

3. The computerized method of claim 1 further comprising:
performing a static scanning operation associated with the decrypted object to determine whether the decrypted object is suspected of including malware; and
classifying the decrypted object to identify a suspected presence of malware when the static scanning operation determines that the decrypted object includes malware.

4. The computerized method of claim 1 , wherein the conducting of the one or more logical operations on the data associated with the first data string and the data within the encrypted object at the first location comprises conducting a first Exclusive OR (XOR) operation on a first plurality of alphanumeric characters and a portion of the encrypted object at a first prescribed address.

5. The computerized method of claim 4 , wherein the one or more logical operations conducted on the second portion of the encrypted object and the data associated with the plaintext version of the second data string further comprises a second Exclusive OR (XOR) operation on the second portion of the encrypted object and the data associated with the plaintext version of the second data string, the data associated with the plaintext version of the second data string includes a second plurality of alphanumeric characters greater in number than the first plurality of alphanumeric characters of the first data string.

6. The computerized method of claim 1 , wherein the conducting of the one or more logical operations on the second portion of the encrypted object and the data associated with the plaintext version of the second data string expected at the second location comprises conducting an Exclusive OR (XOR) operation on the second portion of the encrypted object that corresponds to a plurality of alphanumeric characters and the data associated with the plaintext version of the second data string corresponds to an anticipated plaintext version of the plurality of alphanumeric characters.

7. The computerized method of claim 1 , wherein the data associated with the first data string comprises a first plurality of alphanumeric characters, the result comprises a second plurality of alphanumeric characters greater in number than the first plurality of alphanumeric characters, and the data associated with the second data string comprises a third plurality of alphanumeric characters greater in number than the second plurality of characters.

8. The computerized method of claim 7 , wherein each of the logical operations operates as an Exclusive OR (XOR) operation.

9. The computerized method of claim 1 , wherein prior to decrypting the encrypted object using the cryptographic key, the method further comprises validating the cryptographic key.

10. The computerized method of claim 9 , wherein the validating of the cryptographic key comprises
conducting one or more logical operations on both a third portion of the encrypted object and the cryptographic key to recover a value associated with an address offset;
conducting one or more logical operations on the third portion of the encrypted object at the address offset and the cryptographic key to recover a data string; and
comparing the data string to a prescribed data string expected at the address offset.

11. The computerized method of claim 1 further comprising analyzing the decrypted object by one or more virtual machines and monitoring for anomalous or unexpected activity indicative of the presence of malware.

12. The computerized method of claim 1 , wherein the receiving of the encrypted object comprises (i) determining that the encrypted object is embedded with a second object and (ii) extracting the encrypted object from the second object.

13. A non-transitory computer readable medium that includes software that, when executed by a processor, decrypts an encrypted object having a predetermined format, comprising:
performing one or more logical operations at least on data associated with a first data string expected at a first location within an object having the predetermined format and data within the encrypted object at the first location to recover data associated with a portion of a cryptographic key from the encrypted object;
conducting one or more logical operations at least on the data associated with the cryptographic key and a first portion of the encrypted object at a second location within the encrypted object to produce a result, wherein the second location being different than the first location and the result includes a portion of data associated with a plaintext version of a second data string that is expected at the second location;
responsive to the result including data associated with the plaintext version of the second data string, conducting one or more logical operations at least on a second portion of the encrypted object and the data associated with the plaintext version of the second data string expected at the second location to recover data associated with the cryptographic key, wherein the recovered data associated with the cryptographic key includes the data associated with the portion of the cryptographic key; and
decrypting the encrypted object using the cryptographic key to produce a decrypted object.

14. The non-transitory computer readable medium of claim 13 , wherein the software, when executed by the processor, further perform operations comprising:
performing a static scanning operation associated with the decrypted object, where results of the static scanning operation are used to classify the decrypted object to identify a suspected presence of malware; and
issuing one or more alerts to identify a presence of malware within the encrypted object.

15. The non-transitory computer readable medium of claim 13 , wherein the one or m

Assignees

• Fireeye Inc

Inventors

• Islam Ali

Classifications

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L9/00

  {Cryptographic mechanisms or cryptographic} arrangements for secret or secure communications; Network security protocols · CPC title

• H04L9/08

  Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} · CPC title

• H04L61/1552

  Electricity · mapped topic