Automatic unpacking of executables

1. A method, comprising:

executing a malicious executable to create an unpacked version of the malicious executable in a physical memory;

dumping at least a portion of the physical memory, containing the unpacked version of the malicious executable, to a storage device;

determining an initial entry point for the malicious executable, wherein the initial entry point does not point to an unpacking function for the malicious executable; and

performing one or more post-processing operations to generate a new version of the malicious executable, wherein the new version of the malicious executable includes the initial entry point.

2. The method of claim 1 , wherein the performing the one or more post-processing operations includes:

creating the new version of the malicious executable from a memory image of the unpacked version of the malicious executable.

3. The method of claim 1 , wherein the performing the one or more post-processing operations includes one or more of:

recreating a relocation table of the malicious executable;

recreating an import address table of the malicious executable; and

recreating an export table of the malicious executable.

4. The method of claim 1 , wherein the determining the initial entry point for the malicious executable includes:

determining the unpacking function of the malicious executable; and

identifying the initial entry point for the malicious executable based on a pointer at the end of the unpacking function.

5. The method of claim 4 , wherein the determining the unpacking function of the malicious executable includes:

comparing the malicious executable to the unpacked version of the malicious executable; and

identifying, based on the comparing, a portion of code present in both the malicious executable and the unpacked version of the malicious executable.

6. The method of claim 1 , wherein the dumping at least a portion of the physical memory to the storage device includes:

creating a first memory dump of the physical memory containing the unpacked version of the malicious executable to the storage device;

determining whether any portions of the malicious executable remains packed;

responsive to determining that a first portion of the malicious executable remains packed, unpacking the first portion of the malicious executable to the physical memory; and

creating a second memory dump of the physical memory containing the unpacked first portion of the malicious executable to the storage device.

7. The method of claim 1 , further comprising:

subsequent to unpacking the malicious executable, determining that the unpacking function of the malicious executable is present in the physical memory; and

determining, based on the presence of the unpacking function in the physical memory, that a portion of the malicious executable remains packed.

8. A system, comprising:

one or more processors; and

one or more non-transitory, computer-readable memories coupled to the one or more processors, the one or more memories storing machine-readable instructions that, when executed by the one or more processors, cause the system to perform operations comprising:

unpacking a malicious program file by executing the malicious program file in a first portion of a memory device;

dumping the first portion of the memory device containing the unpacked malicious program file to a second portion of the memory device;

identifying an initial entry point of the malicious program file, wherein the initial entry point does not point to an unpacking function for the malicious program file; and

creating a new version of the malicious program file from a memory image of the unpacked malicious program file, the new version of the malicious program file including the initial entry point.

9. The system of claim 8 , wherein the one or more memories further store machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

identifying the initial entry point of the malicious program file using one or more heuristics.

10. The system of claim 8 , wherein the one or more memories further store machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

determining the unpacking function of the malicious program file; and

identifying the initial entry point of the malicious program file based on a pointer at the end of the unpacking function.

11. The system of claim 8 , wherein the one or more memories further store machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

determining an expected location of the initial entry point in the first portion of the memory device;

identifying candidate initial entry points based on the expected location of the initial entry point; and

selecting one of the candidate initial entry points as the initial entry point of the malicious program file based on an outcome of executing an application corresponding to the one of the candidate initial entry points.

12. The system of claim 11 , wherein the expected location of the initial entry point in the first portion of the memory device is determined based on one or more statistics.

13. The system of claim 11 , wherein the one or more memories further store machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

identifying neighboring addresses of the expected location of the initial entry point in the first portion of the memory device; and

selecting the neighboring addresses as the candidate initial entry points.

14. The system of claim 8 , wherein the one or more memories further store machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform one or more of the following:

recreating a relocation table of the malicious program file;

recreating an import address table of the malicious program file; and

recreating an export table of the malicious program file.

15. A non-transitory, computer-readable medium having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

executing a packed version of a malicious file to create an unpacked version of the malicious file in a physical memory;

dumping at least a portion of the physical memory containing the unpacked version of the malicious file to a storage device;

identifying an unpacking function of the malicious file;

determining an initial entry point for the malicious file, wherein the initial entry point does not point to the unpacking function of the malicious file;

performing one or more post-processing operations based on the unpacking function; and

creating a new version of the malicious file based on the one or more post-processing operations, wherein the new version of the malicious file includes the initial entry point.

16. The non-transitory, computer-readable medium of claim 15 , wherein the determining the initial entry point of the malicious file is based on a pointer at the end of the unpacking function.

17. The non-transitory, computer-readable medium of claim 15 , wherein the determining the initial entry point of the malicious file is based on a jump or call instruction at the end of the unpacking function.

18. The non-transitory, computer-readable medium of claim 15 , wherein the operations further comprise:

identifying a portion of code present in the packed version of the malicious file that is absent from the unpacked version of the malicious file; and

determining that the portion of code present in the packed version of the malicious file that is absent from the unpacked version of the malicious file is the unpacking function.

19. The non-transitory, computer-readable medium of claim 15 , wherein the operations further comprise:

identifying a function that writes to a text section of the malicious file in which code of a corresponding application resides as the unpacking function of the malicious file.

20. The non-transitory, computer-readable medium of claim 15 , wherein the operations further comprise at least one of

recreating a relocation table of the malicious file;

recreating an import address table of the malicious file; and

recreating an export table of the malicious file.