Systems and methods for malware detection in portable executable files
Systems and methods for detecting malware in portable executable (PE) files is provided. A PE file can be received by a server, the PE file can be decompiled into p-code, and one or more predetermined variables can be extracted from the p-code, where the one or more predetermined variables are potentially malicious. The one or more predetermined variables can be backward to its respective source and constant values found in the one or more predetermined variables can be extracted. The constant values can indicate the PE file as malware and preventing the PE file from being executed.
1 . A method for detecting malware in portable executable (PE) files, the method comprising:
receiving, by a server, a PE file;
decompiling, by the server, the PE file into p-code;
extracting, by the server, one or more predetermined variables from the p-code, wherein the one or more predetermined variables are potentially malicious;
obtaining, by the server, a p-code varnode of each of the one or more predetermined variables;
tracking, by the server, the one or more predetermined variables backward to its respective source by:
i) for a p-code varnode that is not a constant value, determining which next p-code varnode to consider next based on an instruction type of the p-code varnode to track backward to arrive at a constant, and
ii) for a p-code varnode that is a constant, extracting the constant values;
determining, by the server, whether the constant values indicate the PE file as malware; and
preventing, by the server, the PE file from being executed.
2 . The method of claim 1 further comprising locating one or more API calls in the decompiled PE file, and wherein extracting the one or more predetermined variables is based on an API definition database.
3 . The method of claim 1 wherein tracking the one or more predetermined variables backward further comprises creating a data flow of all points reached during the backward tracking.
4 . The method of claim 1 further comprising parsing, by the server, the PE file to filter known malware.
5 . The method of claim 1 wherein determining which next p-code varnode to consider next based on an instruction type of the p-code varnode to track backward to arrive at a constant further comprises:
for a p-code varnode having instruction type “INDIRECT” setting the next p-code varnode to consider is the second of two input operand varnodes.
6 . The method of claim 1 wherein determining which next p-code varnode to consider next based on an instruction type of the p-code varnode to track backward to arrive at a constant further comprises:
for a p-code varnode having instruction type “INT_NEGATE”, “INT_ZEXT”, “INTSEXT”, or “CAST, COPY” setting the next p-code varnode to consider as the only input operand varnodes.
7 . The method of claim 1 wherein determining which next p-code varnode to consider next based on an instruction type of the p-code varnode to track backward to arrive at a constant further comprises:
for a p-code varnode having instruction type “INT_ADD”, “INT_SUB”, “INT_MULT”, “INT_DIV”, “INT_AND”, “INT_OR”, “INT_XOR”, or “PIECE, PTRSUB” setting the next p-code varnode to consider as two input operand varnodes.
8 . The method of claim 1 wherein determining which next p-code varnode to consider next based on an instruction type of the p-code varnode to track backward to arrive at a constant further comprises:
for a p-code varnode having instruction type “MULTIEQUAL” setting the next p-code varnode to consider as all input operand varnodes.
9 . One or more non-transitory computer-readable storage media comprising instructions that are executable to cause one or more processors to:
receive a PE file;
decompile the PE file into p-code;
extract one or more predetermined variables from the p-code, wherein the one or more predetermined variables are potentially malicious;
obtaining a p-code varnode of each of the one or more predetermined variables;
track the one or more predetermined variables backward to its respective source by:
i) for a p-code varnode that is not a constant value, determine which next p-code varnode to consider next based on an instruction type of the p-code varnode to track backward to arrive at a constant, and
ii) for a p-code varnode that is a constant, extract the constant values;
extract constant values found in the one or more predetermined variables;
determine, whether the constant values indicate the PE file as malware; and
prevent the PE file from being executed.
10 . The one or more non-transitory computer-readable storage media of claim 9 wherein the one or more processors is further configured to:
locate one or more API calls in the decompiled PE file, and wherein extracting the one or more predetermined variables is based on an API definition database.
11 . The one or more non-transitory computer-readable storage media of claim 9 wherein the tracking further causes the one or more processors to create a data flow of all points reached during the backward tracking.
12 . The one or more non-transitory computer-readable storage media of claim 9 wherein the one or more processors is further configured to parse the PE file to filter known malware.