PolyUnpack: Automating the Hidden-Code Extraction of
Cached
Download Links
BibTeX
@MISC{Malware_polyunpack:automating,
author = {Unpack-executing Malware and Paul Royal and Mitch Halpin and David Dagon and Robert Edmonds and Wenke Lee},
title = {PolyUnpack: Automating the Hidden-Code Extraction of},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Modern malware often hide the malicious portion of their program code by making it appear as data at compiletime and transforming it back into executable code at runtime. This obfuscation technique poses obstacles to researchers who want to understand the malicious behavior of new or unknown malware and to practitioners who want to create models of detection and methods of recovery. In this paper we propose a technique for automating the process of extracting the hidden-code bodies of this class of malware. Our approach is based on the observation that sequences of packed or hidden code in a malware instance can be made self-identifying when its runtime execution is checked against its static code model. In deriving our technique, we formally define the unpack-executing behavior that such malware exhibits and devise an algorithm for identifying and extracting its hidden-code. We also provide details of the implementation and evaluation of our extraction technique; the results from our experiments on several thousand malware binaries show our approach can be used to significantly reduce the time required to analyze such malware, and to improve the performance of malware detection tools. 1.
Keyphrases
hidden-code extraction executable code malware binary malware exhibit program code unpack-executing behavior static code model unknown malware extraction technique malicious behavior obfuscation technique malware detection tool malware instance malicious portion hidden code modern malware hidden-code body runtime execution
