Antimalware scan with decompilation
A system for detection of binary files containing a known malware code fragment includes a processor coupled to a memory storing instructions, the processor being configured to implement the instructions to process an unknown binary file (UBF) and a known malicious source code file (KMSCF) to decompile the UBF into a text-based unknown source code (USC) and identify whether the KMSCF is contained within the USC.
1. A method for detection of binary files containing a known malware code fragment in a computing environment with at least one processor, an unknown binary file (UBF), and a known malicious source code fragment (KMSCF), the method comprising:
decompiling the UBF into a text-based unknown source code (USC) by reconstructing software language constructs from a chain of assembly instructions using heuristics; and
identifying whether the KMSCF is contained within the USC including:
removing at least one comment from the USC and removing at least one format from the USC to create a standardized USC,
comparing the standardized USC against a list of known malicious source code fragments, and
determining at least one logical group of control structures within the USC that match at least one control structure within the known malicious code fragment by applying at least one of pre-compilation, compilation, dynamic execution, or debugging to the USC, wherein when the matching indicates that the KMSCF is found to be present within the USC, a corresponding UBF is considered malicious, and when the KMSCF is not found within the USC, then the corresponding UBF is considered not malicious, or a flag is generated for further analysis or processing.
2. The method of claim 1 , wherein the identifying whether the KMSCF is contained within the USC includes applying a textual search of the list of known malicious source code fragments based on the standardized USC.
3. The method of claim 1 , wherein the identifying whether the KMSCF is contained within the USC includes addressing obfuscation methods used within the USC.
4. The method of claim 1 , wherein the identifying whether the KMSCF is contained within the USC includes applying dynamic operations.
5. The method of claim 1 , wherein the decompiling and identifying are applied to multiple KMSCFs, each including the KMSCF, for a single one of the UBF.
6. The method of claim 5 , wherein, if at least one of the KMSCFs is found to be present within the USC, then a corresponding UBF is considered malicious, and
wherein, if no one of the KMSCFs is found within the USC, then the corresponding UBF is considered not malicious, or a flag is generated for further analysis or processing.
7. The method of claim 1 , wherein decompiling and identifying are applied to multiple KMSCFs, each including the KMSCF, for multiple UBFs, each including the UBF.
8. The method of claim 7 , wherein, if at least one of the KMSCFs is found to be present within the USC, then a corresponding UBF is considered malicious, and
wherein, if no one of the KMSCFs is found within the USC, then the corresponding UBF is considered not malicious, or a flag is generated for further analysis or processing.
9. A system for detection of binary files containing a known malware code fragment, the system comprising:
a processor coupled to a memory storing instructions, the processor being configured to implement the instructions to process an unknown binary file (UBF) and a known malicious source code fragment (KMSCF), to:
decompile the UBF into a text-based unknown source code (USC) by reconstructing software language constructs from a chain of assembly instructions using heuristics; and
identify whether the KMSCF is contained within the USC including:
removing at least one comment from the USC and removing at least one format from the USC to create a standardized USC,
comparing the standardized USC against a list of known malicious source code fragments, and
determining at least one logical group of control structures within the USC that match at least one control structure within the known malicious code fragment by applying at least one of pre-compilation, compilation, dynamic execution, or debugging to the USC, wherein when the matching indicates that the KMSCF is found to be present within the USC, a corresponding UBF is considered malicious, and when the KMSCF is not found within the USC, then the corresponding UBF is considered not malicious, or a flag is generated for further analysis or processing.
10. The system of claim 9 , wherein the processor applies a textual search of the list of known malicious source code fragments based on the standardized USC.
11. The system of claim 9 , wherein the processor addresses obfuscation methods used within the USC.
12. The system of claim 9 , wherein the processor applies dynamic operations to identify if control structures of the KMSCF are present in the USC.
13. The system of claim 9 , wherein the system is applied to multiple KMSCEs, each including the KMSCF, for a single one of the UBF.
14. The system of claim 13 , wherein, if at least one of the KMSCFs is found to be present within the USC, then a corresponding one of the UBF is considered malicious, and
wherein, if no one of the KMSCFs is found within the USC, then the corresponding one of the UBF is considered not malicious, or a flag is generated for further analysis or processing.
15. The system of claim 9 , wherein the system is applied to multiple KMSCEs, each including the KMSCF, for multiple UBFs, each including the UBF.
16. The system of claim 15 , wherein, if at least one of the KMSCFs is found to be present within the USC, a corresponding UBF is considered malicious, and
wherein, if no one of the KMSCFs is found within the USC, the corresponding UBF is considered not malicious, or a flag is generated for further analysis or processing.
17. The method of claim 1 , wherein identifying whether the KMSCF is contained within the USC further comprises identifying at least one section of obfuscated garbage code within the USC.
18. The method of claim 1 , wherein identifying whether the KMSCF is contained within the USC further comprises normalizing at least one variable name within the USC.
19. The system of claim 9 , wherein the processor is further configured to identify whether the KMSCF is contained within the USC further by identifying at least one section of obfuscated garbage code within the USC.
20. The system of claim 9 , wherein the processor is further configured to identify whether the KMSCF is contained within the USC further by normalizing at least one variable name within the USC.