Granted Patent B2

US 12,271,467 · App. 17/562,679 · Granted Apr 8, 2025

Inventor: Jason Neal Raber (Bellbrook, OH)

Assignee: Malwarebytes Corporate Holdco Inc.

G06F21/53G06F9/44521G06F9/54G06F21/566G06F2221/033

Abstract

Claims (78)

1. A method for analyzing a sample file in a sandbox application, the method comprising:

obtaining, at the sandbox application, a blacklist of API functions, wherein the blacklist was generated by a process including:

identifying, based on operating system disassembled dynamic-link libraires, a set of API functions that causes kernel interrupts;

storing the set of API functions having instructions that cause kernel interrupts to an interrupt list;

identifying a plurality of API functions for the blacklist by:

selecting, for the blacklist, at least one API function that directly invokes one of the set of API functions,

selecting, for the blacklist, at least one API function that indirectly invokes one of the set of API functions,

selecting, for the blacklist, at least one API function that invokes one of the set of API functions via one or more nested API functions, and

iteratively selecting, for the blacklist, at least one API function not on the blacklist that calls one of the API functions on the blacklist;

forming the blacklist from the identified plurality of API functions; and

analyzing the sample file in the sandbox application by emulating API functions of the sample file that match the blacklist.

2. The method of claim 1 , wherein identifying the set of API functions that causes kernel interrupts comprises:

identifying an initial set of exported system API functions in a set of disassembled operating system dynamic-link libraries that each invokes one of the identified API functions in the set of API functions in the interrupt list.

3. The method of claim 2 , wherein the process further comprises:

detecting that all API functions in the set of disassembled operating system dynamic-link libraries are either on the blacklist or do not call one of the API functions on the blacklist; and

stopping identifying additional API functions in the set of disassembled operating system dynamic-link libraries.

4. The method of claim 2 , wherein the process further comprises:

identifying API functions in the set of disassembled operating system dynamic-link libraries that are not on the blacklist;

storing the API functions that are not on the blacklist to a whitelist; and

outputting the whitelist to the sandbox application.

5. The method of claim 4 , wherein the sandbox application natively executes API functions invoked by the sample file that match the whitelist.

6. The method of claim 1 , wherein storing the identified set of API functions to the interrupt list comprises:

storing, for each of a set of disassembled operating system dynamic-link libraries, respective partial lists; and

concatenating the partial lists into the interrupt list.

7. The method of claim 1 , wherein identifying the set of API functions that causes kernel interrupts comprises:

identifying the set of API functions that include instructions matching a predefined syntax associated with the kernel interrupts.

8. A non-transitory computer readable storage medium storing instructions for analyzing a sample file in a sandbox application, the instructions when executed by one or more processors causing the one or more processors to perform steps comprising:

obtaining a blacklist of API functions, wherein the blacklist was generated by a process including:

identifying, based on operating system disassembled dynamic-link libraires, a set of API functions that causes kernel interrupts;

storing the set of API functions having instructions that cause kernel interrupts to an interrupt list;

identifying a plurality of API functions for the blacklist by:

selecting, for the blacklist, at least one API function that directly invokes one of the set of API functions,

selecting, for the blacklist, at least one API function that indirectly invokes one of the set of API functions,

selecting, for the blacklist, at least one API function that invokes one of the set of API functions via one or more nested API functions, and

iteratively selecting, for the blacklist, at least one API function not on the blacklist that calls one of the API functions on the blacklist;

forming the blacklist from the identified plurality of API functions; and

analyzing the sample file in the sandbox application by emulating API functions of the sample file that match the blacklist.

9. The non-transitory computer readable storage medium of claim 8 , wherein identifying the set of API functions that causes kernel interrupts comprises:

identifying an initial set of exported system API functions in a set of disassembled operating system dynamic-link libraries that each invokes one of the identified API functions in the set of API functions in the interrupt list.

10. The non-transitory computer readable storage medium of claim 9 , wherein the process further comprises:

detecting that all API functions in the set of disassembled operating system dynamic-link libraries are either on the blacklist or do not call one of the API functions on the blacklist; and

stopping identifying additional API functions in the set of disassembled operating system dynamic-link libraries.

11. The non-transitory computer readable storage medium of claim 9 , wherein the process further comprises:

identifying API functions in the set of disassembled operating system dynamic-link libraries that are not on the blacklist;

storing the API functions that are not on the blacklist to a whitelist; and

outputting the whitelist to the sandbox application.

12. The non-transitory computer readable storage medium of claim 11 , wherein sandbox application natively executes API functions invoked by the sample file that match the whitelist.

13. The non-transitory computer readable storage medium of claim 8 , wherein storing the set of API functions to an interrupt list comprises:

storing, for each of a set of disassembled operating system dynamic-link libraries, respective partial lists; and

concatenating the partial lists into the interrupt list.

14. The non-transitory computer readable storage medium of claim 8 , wherein identifying the API functions that have the respective kernel interrupt functions comprises:

identifying the set of API functions that include instructions matching a predefined syntax associated with the kernel interrupts.

15. A computer system comprising:

one or more processors; and

a non-transitory computer readable storage medium storing instructions for analyzing a sample file in a sandbox application, the instructions when executed by one or more processors causing the one or more processors to perform steps comprising:

obtaining a blacklist of API functions, wherein the blacklist was generated by a process including:

identifying, based on operating system disassembled dynamic-link libraires, a set of API functions that causes kernel interrupts;

storing the set of API functions having instructions that cause kernel interrupts to an interrupt list;

identifying a plurality of API functions for the blacklist by:

selecting, for the blacklist, at least one API function that directly invokes one of the set of API functions,

selecting, for the blacklist, at least one API function that indirectly invokes one of the set of API functions,

selecting, for the blacklist, at least one API function that invokes one of the set of API functions via one or more nested API functions, and

iteratively selecting, for the blacklist, at least one API function not on the blacklist that calls one of the API functions on the blacklist;

forming the blacklist from the identified plurality of API functions; and

analyzing the sample file in the sandbox application by emulating API functions of the sample file that match the blacklist.

16. The computer system of claim 15 , wherein identifying the set of API functions that causes kernel interrupts comprises:

identifying an initial set of exported system API functions in a set of disassembled operating system dynamic-link libraries that each invokes one of the identified API functions in the set of API functions in the interrupt list.

17. The computer system of claim 16 , wherein the process further comprises:

detecting that all API functions in the set of disassembled operating system dynamic-link libraries are either on the blacklist or do not call one of the API functions on the blacklist; and

stopping identifying additional API functions in the set of disassembled operating system dynamic-link libraries.

18. The computer system of claim 16 , wherein the process further comprises:

identifying API functions in the set of disassembled operating system dynamic-link libraries that are not on the blacklist;

storing the API functions that are not on the blacklist to a whitelist; and

outputting the whitelist to the sandbox application.

19. The computer system of claim 18 , wherein sandbox application natively executes API functions invoked by the sample file that match the whitelist.

20. The computer system of claim 15 , wherein storing the identified set of API functions to an interrupt list comprises:

storing, for each of a set of disassembled operating system dynamic-link libraries, respective partial lists; and

concatenating the partial lists into the interrupt list.

Assignments (8)

Continuity (2)

References Cited (14)