Generic unpacking of applications for malware detection
View Patent ↗A technique for detecting malware in an executable allows unpacking of a packed executable before determining whether the executable is malware. In systems with hardware assisted virtualization, hardware virtualization features may be used to iteratively unpack a packed executable in a controlled manner without needing knowledge of a packing technique. Once the executable is completely unpacked, malware detection techniques, such as signature scanning, may be employed to determine whether the executable contains malware. Hardware assisted virtualization may be used to facilitate the scanning of the run-time executable in memory.
1. A non-transitory computer-readable medium comprising instructions stored thereon that when executed cause one or more processing units to:
load a self-extracting executable into memory, the self-extracting executable comprising a first unpacking stub and a packed executable;
allow the first unpacking stub to unpack the packed executable into an unpacked executable;
detect an attempt to write to a memory page in which code was previously executed, by controlling memory page access permissions using hardware assisted virtualization;
detect an attempt to execute code that was previously written into a memory page by the first unpacking stub, by controlling the memory page access permissions using the hardware assisted virtualization;
detect completion of unpacking the packed executable by the first unpacking stub using one or more heuristics; and
scan the unpacked executable for malware,
wherein the one or more heuristics comprise:
comparing a stack pointer value and stack contents recorded prior to detecting completion of the first unpacking stub with a stack pointer value and stack contents recorded prior to allowing the first unpacking stub to begin unpacking the packed executable.
2. The non-transitory computer-readable medium of claim 1 ,
wherein the packed executable is an iteratively packed executable comprising one or more intermediate self-extracting executables,
wherein the instructions that when executed cause the one or more processing units to allow the first unpacking stub to unpack the packed executable comprise instructions that when executed cause at least some of the one or more processing units to:
allow the first unpacking stub to unpack the packed executable into one of the one or more intermediate self-extracting executables; and
allow the one of the one or more intermediate self-extracting executables to unpack successively until a final unpacking stub unpacks a final packed executable into a final unpacked executable,
wherein the instructions that when executed cause the one or more processing units to scan the unpacked executable for malware comprise instructions that when executed cause at least some of one or more processing units to scan the final unpacked executable for malware.
3. The non-transitory computer-readable medium of claim 2 , wherein the instructions that when executed cause one or more processing units to scan the unpacked executable for malware further comprise instructions that when executed cause at least some of the one or more processing units to scan at least one of the one or more intermediate self-extracting executables for malware.
4. The non-transitory computer-readable medium of claim 2 , wherein the final unpacked executable is not allowed to execute if malware is detected.
5. The non-transitory computer-readable medium of claim 1 , wherein the instructions further comprise instructions to cause at least some of the one or more processing units to:
pause execution of the first unpacking stub after detecting the attempt to execute, by using the hardware assisted virtualization;
collect heuristics statistics while execution of the first unpacking stub is paused;
determine whether the memory should be scanned based on the heuristics statistics;
scan the memory based upon the determination; and
allow execution of the first unpacking stub to continue.
6. The non-transitory computer-readable medium of claim 1 , wherein the instructions further comprise instructions to cause at least some of the one or more processing units to detect execution of an entry point of the self-extracting executable, by controlling the memory page access permissions using the hardware assisted virtualization.
7. The non-transitory computer-readable medium of claim 1 , wherein the instructions further comprise instructions to cause at least some of the one or more processing units to:
pause execution of the first unpacking stub after detecting the attempt to write by using the hardware assisted virtualization;
collect heuristics statistics while execution of the first unpacking stub is paused;
determine whether the memory should be scanned based on the heuristics statistics;
scan the memory based upon the determination; and
allow execution of the first unpacking stub to continue.
8. The non-transitory computer-readable medium of claim 1 , wherein the instructions that when executed cause one or more processing units to scan the unpacked executable for malware comprise instructions that when executed cause at least some of the one or more processing units to scan the unpacked executable for malware prior to execution of the unpacked executable.
9. The non-transitory computer-readable medium of claim 1 , wherein the packed executable was packed using an unknown or undetectable packing algorithm.
10. The computer-readable medium of claim 1 , wherein the one or more heuristics further comprise:
determining whether the attempt to execute code is a first attempt to execute code from a code section including the memory page after writing all pages of the code section.
11. The computer-readable medium of claim 1 , wherein the one or more heuristics further comprise:
determining whether a write to a memory page that generates a page write exception is a write to a last page of a section of memory pages.
12. A method of unpacking a self-extracting executable to detect malware, comprising:
loading, using a processor, a self-extracting executable into memory, the self-extracting executable comprising a first unpacking stub and a packed executable;
allowing the first unpacking stub to unpack the packed executable into an unpacked executable;
detecting an attempt to write to a memory page in which code was previously executed, by controlling memory page access permissions using hardware assisted virtualization;
detecting an attempt to execute code that was previously written into a memory page by the first unpacking stub, by controlling the memory page access permissions using the hardware assisted virtualization;
detecting, using the processor, completion of the first unpacking stub using one or more heuristics; and
scanning the unpacked executable for malware,
wherein the one or more heuristics comprise:
comparing a stack pointer value and stack contents recorded prior to detecting completion of the first unpacking stub with a stack pointer value and stack contents recorded prior to allowing the first unpacking stub to begin unpacking the packed executable.
13. The method of claim 12 ,
wherein the packed executable is an iteratively packed executable comprising one or more intermediate self-extracting executables,
wherein allowing the first unpacking stub to unpack the packed executable comprises:
allowing the first unpacking stub to unpack the packed executable into one of the one or more intermediate self-extracting executables; and
allowing the one of the one or more intermediate self-extracting executables to unpack successively until a final unpacking stub unpacks a final packed executable into a final unpacked executable,
wherein the scanning the unpacked executable for malware comprises scanning the final unpacked executable for malware.
14. The method of claim 13 , wherein the scanning the unpacked executable for malware further comprises scanning at least one of the one or more intermediate self-extracting executables for malware.
15. The method of claim 12 , wherein the allowing the first unpacking stub to unpack the packed executable further comprises:
pausing execution of the first unpacking stub after detecting the attempt to write or the attempt to execute, by using the hardware assisted virtualization;
collecting heuristics statistics while execution of the first unpacking stub is paused;
determining whether the memory should be scanned based on the heuristics statistics;
scanning the memory based upon the determination; and
allowing execution of the first unpacking stub to continue.
16. The method of claim 12 , wherein the scanning the unpacked executable is performed prior to execution of the unpacked executable.
17. The method of claim 12 , wherein the packed executable was packed using an unknown or undetectable packing algorithm.
18. The method of claim 12 , wherein the one or more heuristics further comprise:
determining whether the attempt to execute code is a first attempt to execute code from a code section including the memory page after writing all pages of the code section.
19. The method of claim 12 , wherein the one or more heuristics further comprise:
determining whether a write to a memory page that generates a page write exception is a write to a last page of a section of memory pages.
20. A system configured to unpack a self-extracting executable to detect malware, comprising:
a memory; and
one or more processing units, communicatively coupled to the memory, wherein the memory stores instructions to cause the one or more processing units to:
load a self-extracting executable into memory, the self-extracting executable comprising a first unpacking stub and a packed executable;
allow the first unpacking stub to unpack the packed executable into an unpacked executable;
detect an attempt to execute code that was previously written into a memory page by the first unpacking stub, by controlling memory page access permissions using hardware assisted virtualization;
detect an attempt to write to a memory page in which code was previously executed, by controlling the memory page access permissions using the hardware assisted virtualization;
detect completion of unpacking the packed executable by the first unpacking stub using one or more heuristics; and
scan the unpacked executable for malware,
wherein the one or more heuristics comprise:
comparing a stack pointer value and stack contents recorded prior to detecting completion of the first unpacking stub with a stack pointer value and stack contents recorded prior to allowing the first unpacking stub to begin unpacking the packed executable.
21. The system of claim 20 ,
wherein the packed executable is an iteratively packed executable comprising one or more intermediate self-extracting executables,
wherein the instructions to cause one or more processing units to allow the first unpacking stub to unpack the packed executable comprise instructions to cause at least some of the one or more processing units to:
allow the first unpacking stub to unpack the packed executable into one of the one or more intermediate self-extracting executables; and
allow the one of the one or more intermediate self-extracting executables to unpack successively until a final unpacking stub unpacks a final packed executable into a final unpacked executable,
wherein the instructions to cause the one or more processing units to scan the unpacked executable for malware comprise instructions to cause at least some of the one or more processing units to scan the final unpacked executable for malware.
22. The system of claim 21 , wherein the instructions to cause the one or more processing units to scan the unpacked executable for malware further comprise instructions to cause at least some of the one or more processing units to scan at least one of the one or more intermediate self-extracting executables for malware.
23. The system of claim 20 , wherein the instructions to cause the one or more processing units to allow the first unpacking stub to unpack the packed executable further comprise instructions to cause at least some of the one or more processing units to:
pause execution of the first unpacking stub after detecting the attempt to write or the attempt to execute, by using the hardware assisted virtualization;
collect heuristics statistics while execution of the first unpacking stub is paused;
determine whether the memory should be scanned based on the heuristics statistics;
scan the memory based upon the determination; and
allow execution of the first unpacking stub to continue.
24. The system of claim 20 , wherein the one or more heuristics further comprise:
determining whether the attempt to execute code is a first attempt to execute code from a code section including the memory page after writing all pages of the code section.
25. The system of claim 20 , wherein the one or more heuristics further comprise:
determining whether a write to a memory page that generates a page write exception is a write to a last page of a section of memory pages.