Dynamic evaluation of executable files in a lightweight executor
Executable files are evaluated for malware in one or more lightweight executors, such as lightweight executor processes. An executable file is loaded and executed in a lightweight executor. Instructions in an execution path of the executable file are executed. Instructions in another execution path of the executable file are executed in another lightweight executor when a conditional branch instruction in an execution path has a suspicious condition. A fake kernel that mimics a real operating system kernel receives system calls, and responds to the system calls without servicing them in a way the real operating system kernel would. Runtime behavior of the executable file is observed for malware behavior. A response action, such as preventing the executable file from subsequently executing in a computer, is performed when the executable file is detected to be malware.
1. A computer comprising a memory and at least one processor, the memory storing instructions that when executed by the at least one processor cause the computer to:
execute instructions in a first execution path of an executable file;
receive a system call in a fake kernel during execution of the instructions in the first execution path, wherein the fake kernel mimics operation of a real operating system kernel;
respond to the system call by returning a successful result from the fake kernel without servicing the system call in a way the real operating system kernel would;
observe runtime behavior of the executable file during execution of the instructions in the first execution path;
execute instructions in a second execution path of the executable file; and
in response to detecting that the executable file comprises malware based on observed runtime behavior of the executable file, prevent subsequent execution of the executable file,
wherein the instructions in the first execution path are executed in a first user-mode process and the instructions in the second execution path are executed in a second user-mode process, and the first and second user-mode processes are running on different host operating systems.
2. The computer of claim 1 , wherein the system call is for a write operation, and the fake kernel returns the successful result without performing the write operation.
3. A computer-implemented method of evaluating an executable file for malware, the method comprising:
executing instructions in a first execution path of an executable file in a first lightweight executor process;
receiving a system call in a fake kernel during execution of the instructions in the first execution path, wherein the fake kernel mimics operation of a real operating system kernel;
returning a response, by the fake kernel, to the system call without servicing the system call in a way the real operating system kernel would;
observe runtime behavior of the executable file during execution of the instructions in the first execution path;
execute instructions in a second execution path of the executable file in a second lightweight executor process; and
in response to detecting that the executable file comprises malware based on observed runtime behavior of the executable file, prevent subsequent execution of the executable file,
wherein the instructions in the first execution path are executed in a first user-mode process and the instructions in the second execution path are executed in a second user-mode process, and the first and second user-mode processes are running on different host operating systems.
4. The method of claim 3 , further comprising:
detecting a conditional branch instruction in the first execution path, the conditional branch instruction pointing to the second execution path of the executable file,
wherein the instructions in the second execution path of the executable file are executed in the second lightweight executor process in response to detecting that a condition of the conditional branch instruction is indicative of malware.
5. A computer comprising a memory and at least one processor, the memory storing instructions that when executed by the at least one processor cause the computer to:
execute instructions in a first execution path of an executable file;
receive a system call in a fake kernel during execution of the instructions in the first execution path, wherein the fake kernel mimics operation of a real operating system kernel;
respond to the system call by returning a successful result from the fake kernel without servicing the system call in a way the real operating system kernel would;
observe runtime behavior of the executable file during execution of the instructions in the first execution path;
execute instructions in a second execution path of the executable file; and
in response to detecting that the executable file comprises malware based on observed runtime behavior of the executable file, prevent subsequent execution of the executable file,
wherein the instructions in the first execution path are executed in a first user-mode process and the instructions in the second execution path are executed in a second user-mode process, and the first and second user-mode processes are running on a same host operating system.
6. The computer of claim 5 , wherein the system call is for a write operation, and the fake kernel returns the successful result without performing the write operation.
7. A computer-implemented method of evaluating an executable file for malware, the method comprising:
executing instructions in a first execution path of an executable file in a first lightweight executor process;
receiving a system call in a fake kernel during execution of the instructions in the first execution path, wherein the fake kernel mimics operation of a real operating system kernel;
returning a response, by the fake kernel, to the system call without servicing the system call in a way the real operating system kernel would;
observe runtime behavior of the executable file during execution of the instructions in the first execution path;
execute instructions in a second execution path of the executable file in a second lightweight executor process; and
in response to detecting that the executable file comprises malware based on observed runtime behavior of the executable file, prevent subsequent execution of the executable file,
wherein the instructions in the first execution path are executed in a first user-mode process and the instructions in the second execution path are executed in a second user-mode process, and the first and second user-mode processes are running on a same host operating system.
8. The method of claim 7 , further comprising:
detecting a conditional branch instruction in the first execution path, the conditional branch instruction pointing to the second execution path of the executable file,
wherein the instructions in the second execution path of the executable file are executed in the second lightweight executor process in response to detecting that a condition of the conditional branch instruction is indicative of malware.