Malicious JS detection based on automated user interaction emulation
Detection of malicious JavaScript based on automated user interaction emulation is disclosed. A malware sample is executed in an instrumented virtual environment. Dynamic behavior is triggered based on emulated user interactions.
1. A system, comprising:
a processor configured to:
execute a malware sample in an instrumented virtual environment;
identify dynamic behavior that is triggered based on user interactions; and
trigger the dynamic behavior, comprising to:
perform one or more of the following:
A) perform a uniform resource locator (URL) path check, comprising to:
determine that the malware sample requires being executed in a special URL path before triggering the dynamic behavior, wherein the special URL path includes a predefined text string; and
execute the malware sample in a customized specialized URL path that includes the predefined text string;
B) perform a Document Object Model (DOM) element check, comprising to:
determine that the malware sample checks for a presence of one or more DOM elements in a webpage before triggering the dynamic behavior, wherein the one or more DOM elements has a required class and a required identifier; and
create the one or more DOM elements before executing the malware sample, wherein the one or more DOM elements has the required class and the required identifier; and/or
C) perform an input value check, comprising to:
determine that the malware sample requires a correct value of one or more DOM elements before triggering the dynamic behavior, wherein the correct value has a predetermined number of consecutive digits; and
create the correct value having the predetermined number of consecutive digits for the one or more DOM elements before executing the malware sample; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the triggering of the dynamic behavior comprises to:
perform a special event trigger, comprising to:
determine that a special event is triggered before triggering the dynamic behavior; and
hook an event handler to trigger the special event in the event that the malware sample adds the event handler before executing the malware sample.
3. The system of claim 1 , wherein the triggering of the dynamic behavior comprises to:
perform a special event trigger, comprising to:
determine that a timer event is triggered before triggering the dynamic behavior; and
reduce a time out of a timer mechanism for the malware sample to allow the malware sample to be executed sooner before executing the malware sample.
4. The system of claim 1 , wherein the triggering of the dynamic behavior comprises to:
perform a library dependency check, comprising to:
determine that the malware sample requires one or more javascript libraries before triggering the dynamic behavior; and
load the one or more required javascript libraries before executing the malware sample, wherein other javascript libraries are omitted from being loaded.
5. A method, comprising:
executing, using a processor, a malware sample in an instrumented virtual environment;
identifying, using the processor, dynamic behavior that is triggered based on user interactions; and
triggering, using the processor, the dynamic behavior, comprising:
performing one or more of the following:
A) performing a uniform resource locator (URL) path check, comprising:
determining that the malware sample requires being executed in a special URL path before triggering the dynamic behavior, wherein the special URL path includes a predefined text string; and
executing the malware sample in a customized specialized URL path that includes the predefined text string;
B) performing a Document Object Model (DOM) element check, comprising:
determining that the malware sample checks for a presence of one or more DOM elements in a webpage before triggering the dynamic behavior, wherein the one or more DOM elements has a required class and a required identifier; and
creating the one or more DOM elements before executing the malware sample, wherein the one or more DOM elements has the required class and the required identifier; and/or
C) performing an input value check, comprising:
determining that the malware sample requires a correct value of one or more DOM elements before triggering the dynamic behavior, wherein the correct value has a predetermined number of consecutive digits; and
creating the correct value having the predetermined number of consecutive digits for the one or more DOM elements before executing the malware sample.
6. The method of claim 5 , wherein the triggering of the dynamic behavior comprises:
performing a special event trigger, comprising:
determining that a special event is triggered before triggering the dynamic behavior; and
hooking an event handler to trigger the special event in the event that the malware sample adds the event handler before executing the malware sample.
7. The method of claim 5 , wherein the triggering of the dynamic behavior comprises:
performing a special event trigger, comprising:
determining that a timer event is triggered before triggering the dynamic behavior; and
reducing a time out of a timer mechanism for the malware sample to allow the malware sample to be executed sooner before executing the malware sample.
8. The method of claim 5 , wherein the triggering of the dynamic behavior comprises:
performing a library dependency check, comprising:
determining that the malware sample requires one or more javascript libraries before triggering the dynamic behavior; and
loading the one or more required javascript libraries before executing the malware sample, wherein other javascript libraries are omitted from being loaded.
9. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
executing, using a processor, a malware sample in an instrumented virtual environment;
identifying, using the processor, dynamic behavior that is triggered based on user interactions; and
triggering, using the processor, the dynamic behavior, comprising:
performing one or more of the following:
A) performing a uniform resource locator (URL) path check, comprising:
determining that the malware sample requires being executed in a special URL path before triggering the dynamic behavior, wherein the special URL path includes a predefined text string; and
executing the malware sample in a customized specialized URL path that includes the predefined text string;
B) performing a Document Object Model (DOM) element check, comprising:
determining that the malware sample checks for a presence of one or more DOM elements in a webpage before triggering the dynamic behavior, wherein the one or more DOM elements has a required class and a required identifier; and
creating the one or more DOM elements before executing the malware sample, wherein the one or more DOM elements has the required class and the required identifier; and/or
C) performing an input value check, comprising:
determining that the malware sample requires a correct value of one or more DOM elements before triggering the dynamic behavior, wherein the correct value has a predetermined number of consecutive digits; and
creating the correct value having the predetermined number of consecutive digits for the one or more DOM elements before executing the malware sample.