Heuristic detection of malicious computer code by page tracking

1. A computer-implemented method for detecting malicious code in a host file, the method comprising the steps of:

emulating the host file in a virtual machine having a virtual memory;

tracking access of the virtual memory by the host file;

detecting potential malicious code based at least in part on whether the host file accessed the virtual memory within a non-normal address range, wherein the non-normal address range of the virtual memory includes a portion of the virtual memory containing an address for an API function; and

reporting whether potential malicious code in the host file was detected based at least in part on the detecting.

2. The method of claim 1 , wherein detecting the potential malicious code comprises the steps of:

setting a flag responsive to the access of the virtual memory within the non-normal address range; and

declaring the potential malicious code based on the status of the flag.

3. The method of claim 1 , wherein emulating the host file comprises the steps of:

identifying a potential entry point for the malicious code in the host file; and

emulating instructions in the host file around the entry point.

4. The method of claim 1 , wherein the non-normal address range is a section of a file other than a section containing executable code.

5. The method of claim 1 , wherein the non-normal address range is a header portion of a dynamically linked library.

6. The method of claim 5 , wherein the dynamically linked library is KERNLL32.DLL.

7. The method of claim 1 , wherein the access of the virtual memory is a read operation.

8. The method of claim 1 , wherein the host file is in the PE (portable executable) format.

9. A computer program product comprising a computer-readable medium containing computer program code for detecting malicious code in a host file, the computer program code comprising instructions for performing the steps of:

emulating the host file in a virtual machine having a virtual memory;

tracking access of the virtual memory by the host file;

detecting potential malicious code based at least in part on whether the host file accessed the virtual memory within a non-normal address range, wherein the non-normal address range of the virtual memory includes a portion of the virtual memory containing an address for an API function; and

reporting whether potential malicious code in the host file was detected based at least in part on the detecting.

10. The computer program product of claim 9 , wherein detecting the potential malicious code comprises the steps of:

setting a flag based at least on part to the access of the virtual memory within the non-normal address range; and

declaring the potential malicious code based on the status of the flag.

11. The computer program product of claim 9 , wherein emulating the host file comprises the steps of:

identifying a potential entry point for the malicious code in the host file; and

emulating instructions in the host file around the entry point.

12. The computer program product of claim 9 , wherein the non-normal address range is a section of a file other than a section containing executable code.

13. The computer program product of claim 9 , wherein the non-normal address range is a header portion of a dynamically linked library.

14. The computer program product of claim 13 , wherein the dynamically linked library is KERNLL32.DLL.

15. The computer program product of claim 9 , wherein the access of the virtual memory is a read operation.

16. The computer program product of claim 9 , wherein the host file is in the PE (portable executable) format.

17. A computer program product comprising a computer-readable storage medium containing computer program code for detecting malicious code in a host file, the computer program code comprising:

an emulating module for emulating the host file in a virtual machine having a virtual memory;

a flag recording module adapted to set a flag based at least in part on whether the host file accessed a non-normal address range of the virtual memory, wherein the non-normal address range of the virtual memory includes a portion of the virtual memory containing an address for an API function; and

a virus reporting module adapted to declare potential malicious code based on whether the flag is set.

18. The computer program product of claim 17 , further comprising:

a virus database module for storing at least one address range of the virtual memory defined as non-normal.

19. The computer program product of claim 17 , wherein the virus reporting module declares potential malicious code based on the flag in combination with additional heuristics.

20. The computer program product of claim 17 , wherein the non-normal address range is a section of a file other than a section containing executable code.

21. The computer program product of claim 17 , wherein the non-normal address range is a header portion of a dynamically linked library.

22. The computer program product of claim 17 , wherein the host file is in the PE (portable executable) format.

23. A virus detection system for detecting malicious code in a host file, the system comprising:

a storage medium for storing a plurality of software modules;

a processor for executing the software modules;

an emulating module for emulating the host file in a virtual machine having a virtual memory;

a flag recording module coupled to the emulating module, the flag recording module adapted to set a flag based at least on part on whether the host file accessed a non-normal address range of the virtual memory, wherein the non-normal address range of the virtual memory includes a portion of the virtual memory containing an address for an API function; and

a virus reporting module coupled to the flag recording module, the virus reporting module adapted to declare potential malicious code based on whether the flag is set.

24. The virus detection system of claim 23 , further comprising:

a virus database module coupled to the flag recording module, the virus database module storing one or more address ranges of the virtual memory defined as non-normal.

25. The virus detection system of claim 23 , wherein the virus reporting module declares potential malicious code based on the flag in combination with additional heuristics.

26. The virus detection system of claim 23 , wherein the non-normal address range is a section of a file other than a section containing executable code.

27. The virus detection system of claim 23 , wherein the non-normal address range is a header portion of a dynamically linked library.

28. The virus detection system of claim 23 , wherein the host file is in the PE (portable executable) format.