System and method for characterizing malware
An embodiment may create a memory image including a representation of a thread environment block (TEB) and representation of a process environment block (PEB) according to specifications of an operating system. A memory image may be loaded into a memory and a shellcode may be caused to use the memory image when executed. An access to the memory image, made by the shellcode, may be monitored and controlled.
1. A computer-implemented method for executing a shellcode in a controlled environment, the method comprising:
creating, in a memory of a computing device, a Process Environment Block (PEB) according to specifications of an operating system (OS);
generating a representation of a set of Dynamic-link libraries (DLLs) by analyzing a set of DLLs wherein the representation of the set of DLLs includes at least an address and a name of at least one DLL;
loading the representations of the set of DLLs into the memory at a location according to a Local Descriptor Table (LDT);
loading a shellcode into the memory and causing a controller to execute the shellcode;
controlling access, by the shellcode, to the representation of the set of DLLs; and
accelerating access, made by the shellcode, to the representation of the set of DLLs, by including only a predefined small set of DLLs descriptors in the PEB wherein the small set is defined based on identifying DLLs typically called by a shellcode.
2. The method of claim 1 , comprising randomizing addresses in the PEB by randomly ordering DLLs descriptors in the PEB.
3. The method of claim 1 , wherein an OS used by the computing device is different from an OS targeted by the shellcode.
4. The method of claim 1 , wherein the representation of the DLL's includes only metadata related to the DLL's and does not include actual executable code.
5. The method of claim 1 , wherein the representation of a DLL includes custom executable code designed to trigger an action when the DLL is called.
6. The method of claim 1 , comprising generating the representation of the DLLs based on at least one of: a type of an OS, a set of DLLs, a memory address of a DLL.
7. The method of claim 1 , comprising randomizing, in the representation of the DLL's, at least one of: addresses of DLLs and the order of functions included in DLLs.
8. The method of claim 1 , comprising creating, in the memory, a representation of a Thread Environment Block (TEB), wherein the representations of the TEB, PEB and DLLs is aggregated into one portable, small, lightweight, memory representation and wherein the portable light memory representation is loaded into the memory.
9. A computer-implemented method for generating a memory representation, the method comprising:
creating, in a memory image:
a representation of a Process Environment Block (PEB) according to specifications of an operating system (OS), and
a representation of a set of Dynamic-link libraries (DLLs), wherein the representation of the set of DLLs includes at least an address and a name of at least one DLL;
loading the memory image to a location pointed by a Local Descriptor Table (LDT);
executing the shellcode;
monitoring accesses, made by the shellcode, to the representation of the set of DLLs; and
accelerating access, made by the shellcode, to the representation of the set of DLLs, by including only a predefined small set of DLLs descriptors in the PEB wherein the small set is defined based on identifying DLLs typically called by a shellcode.
10. A system comprising:
a memory; and
a controller, the controller configured to:
create, in a memory of a computing device, a representation of a Process Environment Block (PEB) according to specifications of an operating system (OS);
generate a representation of a set of Dynamic-link libraries (DLLs) by analyzing a set of DLLs wherein the representation includes at least an address and a name of at least one DLL;
load the representation of the set of DLLs into the memory at a location pointed by a Local Descriptor Table (LDT);
load a shellcode into the memory and cause a controller to execute the shellcode;
control access, by the shellcode, to the representation of the set of DLLs; and
accelerate access, made by the shellcode, to the representation of the set of DLLs, by including only a predefined small set of DLLs descriptors in the PEB wherein the small set is defined based on identifying DLLs typically called by a shellcode.
11. The system of claim 10 , wherein the controller is further to randomizing addresses in the PEB by randomly ordering DLLs descriptors in the PEB.
12. The system of claim 10 , wherein an OS used by the controller is different from an OS targeted by the shellcode.
13. The system of claim 10 , wherein the representation of the DLL's includes only metadata related to the DLL's and does not include actual executable code.
14. The system of claim 10 , wherein the representation of a DLL includes custom executable code designed to trigger an action when the DLL is called.
15. The system of claim 10 , wherein the controller is further to configured to generate the representation of the DLLs based on at least one of: a type of an OS, a set of DLLs, a memory address of a DLL.
16. The system of claim 10 , wherein the controller is further to configured to randomizing, in at least one of the representations, at least one of:
addresses of DLLs and the order of functions included in DLLs.
17. The system of claim 10 , comprising creating, in the memory, a representation of a Thread Environment Block (TEB), wherein the representations of the TEB, PEB and DLLs is aggregated into one portable light memory representation and wherein the portable light memory representation is loaded into the memory.
18. The system of claim 10 , comprising creating, in the memory, a representation of a Thread Environment Block (TEB) and generating a set of light memory representations of the TEB, PEB and DLLs based on behaviors of a respective set of malwares.