Segregating executable files exhibiting network activity
View Patent ↗An executable file is loaded into memory. The executable file is analyzed to determine whether one or more dynamically linked libraries are referenced in an import table of the file. It can then be determined whether one or more dynamically linked libraries is adapted to contact a network.
1. An apparatus comprising:
one or more processing elements; and
a memory, coupled to the one or more processing elements;
a dynamically linked library (DLL) analyzer loadable into the memory, comprising instructions that when executed cause the one or more processing elements to:
determine whether one or more DLLs used by an executable file are adapted to perform network activity;
scan an import descriptor data structure module of the executable file for a reference to a dynamically linked library known to perform network activity;
an executable file analyzer loadable into the memory, comprising instructions that when executed cause the one or more processing elements to:
determine whether the executable file is packed or unpacked;
enumerate the executable file responsive to a determination that the executable file is unpacked;
detect use of one or more DLLs responsive to a determination that the executable file is packed;
invoke the DLL analyzer to process the executable file, responsive to detecting use of one or more executable DLLs; and
perform malware analysis responsive to the determination by the DLL analyzer that the one or more DLLs are adapted to perform network activity.
2. The apparatus of claim 1 , wherein the DLL analyzer further comprises instructions that when executed cause the one or more processing elements to:
identify one or more dynamically linked libraries adapted to perform network activity referenced by the executable file; and
determine whether the one or more dynamically linked libraries perform network activity.
3. The apparatus of claim 1 , wherein the DLL analyzer further comprises instructions that when executed cause the one or more processing elements to:
hook processing of the executable file responsive to determining at least one dynamically linked library adapted to perform network activity is used by the executable file.
4. The apparatus of claim 1 , wherein the memory further comprises instructions to cause the one or more processing elements to:
allow execution of the executable file responsive to determining no dynamically linked library adapted to perform network activity is used by the executable file.
5. The apparatus of claim 4 , wherein the DLL analyzer further comprises instructions that when executed cause the one or more processing elements to:
hook execution of the executable file responsive to identifying network activity by a dynamically linked library.
6. The apparatus of claim 1 , wherein the executable file comprises a portable executable file.
7. A non-transitory computer readable storage medium comprising computer readable code comprising:
a dynamically linked library (DLL) analyzer, comprising instructions that when executed cause the one or more processing elements to:
determine whether one or more DLLs used by an executable file are adapted to perform network activity;
scan an import descriptor data structure module of the executable file for a reference to a dynamically linked library known to perform network activity;
an executable file analyzer, comprising instructions that when executed cause the one or more processing elements to:
determine whether the executable file is packed or unpacked;
enumerate the executable file responsive to a determination that the executable file is unpacked;
detect use of one or more DLLs responsive to a determination that the executable file is packed;
invoke the DLL analyzer to process the executable file, responsive to detecting use of one or more executable DLLs; and
perform malware analysis responsive to the determination by the DLL analyzer that the one or more DLLs are adapted to perform network activity.
8. The non-transitory computer readable medium of claim 7 , wherein the DLL analyzer further comprises instructions that when executed cause the one or more processing elements to:
identify one or more dynamically linked libraries adapted to perform network activity referenced by the executable file; and
determine whether the one or more dynamically linked libraries perform network activity.
9. The non-transitory computer readable medium of claim 7 , wherein the DLL analyzer further comprises instructions that when executed cause the one or more processing elements to:
hook processing of the executable file responsive to determining at least one dynamically linked library adapted to perform network activity is used by the executable file.
10. The non-transitory computer readable medium of claim 7 , further comprising instructions to cause the one or more processing elements to:
allow execution of the executable file responsive to determining no dynamically linked library adapted to perform network activity is used by the executable file.
11. The non-transitory computer readable medium of claim 10 , wherein the DLL analyzer further comprises instructions that when executed cause the one or more processing elements to:
hook execution of the executable file responsive to identifying network activity by a dynamically linked library.
12. The non-transitory computer readable medium of claim 7 , wherein the executable file comprises a portable executable file.
13. A method comprising:
determining whether one or more dynamically linked libraries (DLLs) used by an executable file are adapted to perform network activity;
scanning an import descriptor data structure module of the executable file for a reference to a dynamically linked library known to perform network activity;
determining whether the executable file is packed or unpacked;
enumerating the executable file responsive to a determination that the executable file is unpacked;
detecting use of one or more DLLs responsive to a determination that the executable file is packed;
invoking a DLL analyzer to process the executable file, responsive to detecting use of one or more executable DLLs; and
performing malware analysis responsive to the determination by the DLL analyzer that the one or more DLLs are adapted to perform network activity.
14. The method of claim 13 , further comprising:
identifying one or more dynamically linked libraries adapted to perform network activity referenced by the executable file; and
determining whether the one or more dynamically linked libraries perform network activity.
15. The method of claim 13 , further comprising:
hooking processing of the executable file responsive to determining at least one dynamically linked library adapted to perform network activity is used by the executable file.
16. The method of claim 13 , further comprising:
allowing execution of the executable file responsive to determining no dynamically linked library adapted to perform network activity is used by the executable file.
17. The method of claim 16 , further comprising:
hooking execution of the executable file responsive to identifying network activity by a dynamically linked library.
18. The method of claim 13 , wherein the executable file comprises a portable executable file.