Generic unpacking of applications for malware detection
View Patent ↗A technique for detecting malware in an executable allows unpacking of a packed executable before determining whether the executable is malware. In systems with hardware assisted virtualization, hardware virtualization features may be used to iteratively unpack a packed executable in a controlled manner without needing knowledge of a packing technique. Once the executable is completely unpacked, malware detection techniques, such as signature scanning, may be employed to determine whether the executable contains malware. Hardware assisted virtualization may be used to facilitate the scanning of the run-time executable in memory.
1. A non-transitory computer-readable medium on which is stored software for unpacking a self-extracting executable, comprising instructions that when executed cause one or more processing units to:
load the self-extracting executable into memory, the self-extracting executable comprising a first unpacking stub and a packed executable;
allow the first unpacking stub to unpack the packed executable into an unpacked executable;
detect an attempt to write to a memory page in which code was previously executed, by controlling memory page access permissions using hardware assisted virtualization;
detect completion of unpacking the packed executable by the first unpacking stub using one or more heuristics; and scan the unpacked executable for malware, wherein the one or more heuristics comprise:
determining whether a write to a memory page that generates a page write exception is a write to a last page of a section of memory pages.
2. The non-transitory computer-readable medium of claim 1 ,
wherein the packed executable is an iteratively packed executable comprising one or more intermediate self-extracting executables,
wherein the instructions to cause one or more processing units to allow the first unpacking stub to unpack the packed executable comprise instructions to cause one or more processing units to:
allow the first unpacking stub to unpack the packed executable into one of the one or more intermediate self-extracting executables; and
allow the one of the one or more intermediate self-extracting executables to unpack successively until a final unpacking stub unpacks a final packed executable into a final unpacked executable,
wherein the instructions to cause one or more processing units to scan the unpacked executable for malware comprise instructions to cause one or more processing units to scan the final unpacked executable for malware.
3. The non-transitory computer-readable medium of claim 2 , wherein the instructions to cause one or more processing units to scan the unpacked executable for malware further comprise instructions to cause one or more processing units to scan at least one of the one or more intermediate self-extracting executables for malware.
4. The non-transitory computer-readable medium of claim 2 , wherein the final unpacked executable is not allowed to execute if malware is detected.
5. The non-transitory computer-readable medium of claim 1 , wherein the instructions to cause one or more processing units to allow the first unpacking stub to unpack the packed executable comprise instructions to cause one or more processing units to use hardware assisted virtualization to control memory page access permissions to detect an attempt to execute code that was previously written into a memory page by the first unpacking stub.
6. The non-transitory computer-readable medium of claim 5 , wherein the instructions to cause one or more processing units to allow the first unpacking stub to unpack the packed executable further comprise instructions to cause one or more processing units to:
use hardware assisted virtualization to, after detecting the attempt, pause execution of the first unpacking stub;
collect heuristics statistics while execution of the first unpacking stub is paused;
determine whether memory should be scanned based on the heuristics statistics;
scan memory based upon the determination; and
allow execution of the first unpacking stub to continue.
7. The non-transitory computer-readable medium of claim 1 , wherein the instructions to cause one or more processing units to allow the first unpacking stub to unpack the packed executable comprise instructions to cause one or more processing units to use hardware assisted virtualization to control memory page access permissions to detect execution of an entry point of the self-extracting executable.
8. The non-transitory computer-readable medium of claim 1 , wherein the one or more heuristics further comprise:
determining whether an attempt to execute code is a first attempt to execute code from a code section including the memory page after writing all pages of the code section.
9. The non-transitory computer-readable medium of claim 8 , wherein the instructions to cause one or more processing units to allow the first unpacking stub to unpack the packed executable further comprise instructions to cause one or more processing units to:
use hardware assisted virtualization to, after detecting the writing, pause execution of the first unpacking stub;
collect heuristics statistics while execution of the first unpacking stub is paused;
determine whether memory should be scanned based on the heuristics statistics;
scan memory based upon the determination; and
allow execution of the first unpacking stub to continue.
10. The non-transitory computer-readable medium of claim 1 , wherein scanning the unpacked executable is performed prior to execution of the unpacked executable.
11. The non-transitory computer-readable medium of claim 1 , wherein the packed executable was packed using an unknown or undetectable packing algorithm.
12. The non-transitory computer-readable medium of claim 1 , wherein the one or more heuristics comprise a heuristic to compare a stack pointer value and stack contents recorded prior to detecting completion of the first unpacking stub with a stack pointer value and stack contents recorded prior to allowing the first unpacking stub to begin unpacking the packed executable.
13. The non-transitory computer-readable medium of claim 1 , wherein the instructions to cause one or more processing units to allow the first unpacking stub to unpack the packed executable comprise instructions to cause one or more processing units to control execution of the first unpacking stub while allowing the first unpacking stub to unpack the packed executable into an unpacked executable.
14. A method of unpacking a self-extracting executable to detect malware, comprising:
loading, using a processor, the self-extracting executable into memory, the self-extracting executable comprising a first unpacking stub and a packed executable;
allowing the first unpacking stub to unpack the packed executable into an unpacked executable;
detecting an attempt to write to a memory page in which code was previously executed, by controlling memory page access permissions using hardware assisted virtualization;
detecting, using a processor, completion of the first unpacking stub using one or more heuristics; and scanning the unpacked executable for malware, wherein the one or more heuristics comprise:
determining whether a write to a memory page that generates a page write exception is a write to a last page of a section of memory pages.
15. The method of claim 14 ,
wherein the packed executable is an iteratively packed executable comprising one or more intermediate self-extracting executables,
wherein allowing the first unpacking stub to unpack the packed executable comprises:
allowing the first unpacking stub to unpack the packed executable into one of the one or more intermediate self-extracting executables; and
allowing the one of the one or more intermediate self-extracting executables to unpack successively until a final unpacking stub unpacks a final packed executable into a final unpacked executable, and
wherein scanning the unpacked executable for malware comprises scanning the final unpacked executable for malware.
16. The method of claim 15 , wherein scanning the unpacked executable for malware further comprises scanning at least one of the one or more intermediate self-extracting executables for malware.
17. The method of claim 14 , wherein allowing the first unpacking stub to unpack the packed executable comprises using hardware assisted virtualization to control memory page access permissions to detect an attempt to execute code that was previously written into a memory page by the first unpacking stub.
18. The method of claim 17 , wherein allowing the first unpacking stub to unpack the packed executable further comprises:
using hardware assisted virtualization to, after detecting the attempt, pause execution of the first unpacking stub;
collecting heuristics statistics while execution of the first unpacking stub is paused;
determining whether memory should be scanned based on the heuristics statistics;
scanning memory based upon the determination; and
allowing execution of the first unpacking stub to continue.
19. The method of claim 14 , wherein scanning the unpacked executable is performed prior to execution of the unpacked executable.
20. The method of claim 14 , wherein the packed executable was packed using an unknown or undetectable packing algorithm.
21. A system configured to unpack a self-extracting executable to detect malware, comprising:
a memory; and one or more processing units, communicatively coupled to the memory, wherein the memory stores instructions to cause the one or more processing units to:
load the self-extracting executable into memory, the self-extracting executable comprising a first unpacking stub and a packed executable;
allow the first unpacking stub to unpack the packed executable into an unpacked executable;
detect an attempt to write to a memory page in which code was previously executed, by controlling memory page access permissions using hardware assisted virtualization;
detect completion of the first unpacking stub using one or more heuristics; and scan the unpacked executable for malware, wherein the one or more heuristics comprise:
determining whether a write to a memory page that generates a page write exception is a write to a last page of a section of memory pages.
22. The system of claim 21 ,
wherein the packed executable is an iteratively packed executable comprising one or more intermediate self-extracting executables,
wherein the instructions to cause one or more processing units to allow the first unpacking stub to unpack the packed executable comprise instructions to cause one or more processing units to:
allow the first unpacking stub to unpack the packed executable into one of the one or more intermediate self-extracting executables; and
allow the one of the one or more intermediate self-extracting executables to unpack successively until a final unpacking stub unpacks a final packed executable into a final unpacked executable,
wherein the instructions to cause one or more processing units to scan the unpacked executable for malware comprise instructions to cause one or more processing units to scan the final unpacked executable for malware.
23. The system of claim 22 , wherein the instructions to cause one or more processing units to scan the unpacked executable for malware further comprise instructions to cause one or more processing units to scan at least one of the one or more intermediate self-extracting executables for malware.
24. The system of claim 21 , wherein the instructions to cause one or more processing units to allow the first unpacking stub to unpack the packed executable comprise instructions to cause one or more processing units to use hardware assisted virtualization to control memory page access permissions to detect an attempt to execute code that was previously written into a memory page by the first unpacking stub.
25. The system of claim 21 , wherein the instructions to cause one or more processing units to allow the first unpacking stub to unpack the packed executable further comprise instructions to cause one or more processing units to:
use hardware assisted virtualization to, after detecting the attempt, pause execution of the first unpacking stub;
collect heuristics statistics while execution of the first unpacking stub is paused;
determine whether memory should be scanned based on the heuristics statistics;
scan memory based upon the determination; and
allow execution of the first unpacking stub to continue.