Analyzing multiple CPU architecture malware samples

1. A system, comprising:

a processor configured to:

receive a first sample for analysis, wherein the first sample was compiled for a first CPU architecture;

determine that the first CPU architecture is different from a host CPU architecture; and

execute the first sample in an emulated user space corresponding to the first CPU architecture for which the first sample was compiled, wherein:

the emulated user space is provided by executing a user space emulation utility in a virtual machine that shares the host CPU architecture;

while executing, the first sample causes a download of a second sample that was compiled for a second CPU architecture that is different from the first CPU architecture and also different from the host CPU architecture;

the second sample is emulated in a user space corresponding to the second CPU architecture; and

analysis of the first sample and the second sample is performed by a single virtual machine instance during a single dynamic analysis session; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 , wherein a virtual machine environment is initialized with a set comprising a plurality of versions of a particular library, wherein each of the plurality of versions corresponds to a different CPU architecture.

3. The system of claim 2 , wherein, when the first sample is executed, a library selected from the set, and corresponding to the first CPU architecture for which the first sample was compiled, is loaded.

4. The system of claim 1 , wherein the determination that the first sample was compiled for the first CPU architecture that is different from the host CPU architecture is performed by a loader.

5. The system of claim 1 , wherein the processor is further configured to patch at least one of the first sample and an execution environment associated with executing the first sample.

6. The system of claim 5 , wherein the patching includes patching a path to a library.

7. The system of claim 6 , wherein patching the path to the library includes substituting a path to an alternate library as compiled for the first CPU architecture that is different from the host CPU architecture with a path to the library as compiled for the host CPU architecture.

8. The system of claim 1 , wherein monitoring of the executing of the first sample is performed by a guest operating system and wherein the guest operating system executes the first sample in the emulated user space.

9. The system of claim 1 , wherein the processor is further configured to determine a verdict for the first sample.

10. A method, comprising:

receiving a first sample for analysis, wherein the first sample was compiled for a first CPU architecture;

determining that the first CPU architecture is different from a host CPU architecture; and

executing the first sample in an emulated user space corresponding to the first CPU architecture for which the first sample was compiled, wherein:

the emulated user space is provided by executing a user space emulation utility in a virtual machine that shares the host CPU architecture;

while executing, the first sample causes a download of a second sample that was compiled for a second CPU architecture that is different from the first CPU architecture and also different from the host CPU architecture;

the second sample is emulated in a user space corresponding to the second CPU architecture; and

analysis of the first sample and the second sample is performed by a single virtual machine instance during a single dynamic analysis session.

11. The method of claim 10 , wherein a virtual machine environment is initialized with a set comprising a plurality of versions of a particular library, wherein each of the plurality of versions corresponds to a different CPU architecture.

12. The method of claim 11 , wherein, when the first sample is executed, a library selected from the set, and corresponding to the first CPU architecture for which the first sample was compiled, is loaded.

13. The method of claim 10 , wherein the determination that the first sample was compiled for the first CPU architecture that is different from the host CPU architecture is performed by a loader.

14. The method of claim 10 , further comprising patching at least one of the first sample and an execution environment associated with executing the first sample.

15. The method of claim 14 , wherein the patching includes patching a path to a library.

16. The method of claim 15 , wherein patching the path to the library includes substituting a path to an alternate library as compiled for the first CPU architecture that is different from the host CPU architecture with a path to the library as compiled for the host CPU architecture.

17. The method of claim 10 , wherein monitoring of the executing of the first sample is performed by a guest operating system and wherein the guest operating system executes the first sample in the emulated user space.

18. The method of claim 10 , further comprising determining a verdict for the first sample.

19. A computer program product embodied in a tangible, non-transitory computer readable storage medium and comprising computer instructions for:

receiving a first sample for analysis, wherein the first sample was compiled for a first CPU architecture;

determining that the first CPU architecture is different from a host CPU architecture; and

executing the first sample in an emulated user space corresponding to the first CPU architecture for which the first sample was compiled, wherein:

the emulated user space is provided by executing a user space emulation utility in a virtual machine that shares the host CPU architecture;

while executing, the first sample causes a download of a second sample that was compiled for a second CPU architecture that is different from the first CPU architecture and also different from the host CPU architecture;

the second sample is emulated in a user space corresponding to the second CPU architecture; and

analysis of the first sample and the second sample is performed by a single virtual machine instance during a single dynamic analysis session.