Dynamic analysis techniques for applications
A sample is analyzed to determine a set of events that should be selected for performing by a dynamic analyzer executing the sample in an instrumented, emulated environment. The set of selected events is performed. A maliciousness verdict is determined for the sample based at least in part on one or more responses taken by the sample in response to the set of selected events being performed by the dynamic analyzer.
1. A system, comprising:
a processor configured to:
analyze a sample to determine a set of actions that should be taken by a dynamic analyzer executing the sample in an instrumented, emulated environment, wherein determining the set of actions includes evaluating user interface elements of the sample and identifying which of the user interface elements of the sample are actionable;
imitate user interaction behavior at least in part by performing the set of actions; and
determine a maliciousness verdict for the sample based at least in part on one or more responses taken by the sample in response to the set of actions being performed by the dynamic analyzer; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 wherein determining the set of actions includes extracting the sample's user interface layout into a tree hierarchy of user interface elements.
3. The system of claim 2 wherein performing the set of selected actions includes interacting with at least one user interface element.
4. The system of claim 1 wherein determining which elements of the sample are actionable includes determining which elements of the sample have previously been interacted with.
5. The system of claim 1 wherein analyzing the sample includes evaluating a manifest file.
6. The system of claim 5 wherein performing the set of selected actions includes simulating a system event.
7. The system of claim 5 wherein performing the set of selected actions includes forcibly launching a component.
8. The system of claim 1 wherein the processor is further configured to perform an emulator detection resistance action.
9. The system of claim 8 wherein performing the emulator detection resistance action includes returning a random value in response to receiving a system call.
10. The system of claim 8 wherein performing the emulator detection resistance action includes modifying a system static constant field.
11. The system of claim 8 wherein performing the emulator detection resistance action includes receiving a file open request from the sample, determining that the file is on a list, and redirecting a file handler associated with the file.
12. The system of claim 8 wherein performing the emulator detection resistance action includes generating artificial user data.
13. The system of claim 12 wherein the artificial user data includes artificial contacts.
14. The system of claim 12 wherein the processor is further configured to detect when the sample attempts to access at least some of the artificial user data and in response log the attempted access.
15. A method, comprising:
analyzing a sample to determine a set of actions events that should be taken by a dynamic analyzer executing the sample in an instrumented, emulated environment, wherein determining the set of actions includes evaluating user interface elements of the sample and identifying which of the user interface elements of the sample are actionable;
imitating user interaction behavior at least in part by performing the set of actions; and
determining a maliciousness verdict for the sample based at least in part on one or more responses taken by the sample in response to the set of actions being performed by the dynamic analyzer.
16. The method of claim 15 wherein analyzing the sample includes evaluating a manifest file.
17. The method of claim 16 wherein performing the set of selected actions includes simulating a system event.
18. The method of claim 16 wherein performing the set of selected actions includes forcibly launching a component.
19. The method of claim 15 further comprising performing an emulator detection resistance action.
20. The method of claim 19 wherein performing the emulator detection resistance action includes returning a random value in response to receiving a system call.
21. The method of claim 19 wherein performing the emulator detection resistance action includes modifying a system static constant field.
22. The method of claim 19 wherein performing the emulator detection resistance action includes receiving a file open request from the sample, determining that the file is on a list, and redirecting a file handler associated with the file.
23. The method of claim 19 wherein performing the emulator detection resistance action includes generating artificial user data.
24. The method of claim 23 wherein the artificial user data includes artificial contacts.
25. The method of claim 23 further comprising detecting when the sample attempts to access at least some of the artificial user data and in response log the attempted access.
26. The method of 15 wherein determining the set of actions includes extracting the sample's user interface layout into a tree hierarchy of user interface elements.
27. The method of claim 26 wherein performing the set of selected actions includes interacting with at least one user interface element.
28. The method of claim 15 wherein determining which elements of the sample are actionable includes determining which elements of the sample have previously been interacted with.