Malicious code sample extraction method and system based on document type bug

Abstract

The invention discloses a malicious code sample extraction method and a system based on a document type bug. The method comprises the steps that a shellcode in a document is positioned; the positioned shellcode is extracted, and then converted into a PE (Portable Executable) file; the PE file is operated; whether the PE file releases a file is judged; if so, the released file serves as a malicious code sample to be extracted; if not, whether the PE file downloads a file is judged; if so, the downloaded file serves as a malicious code sample to be extracted; and if not, malicious code sample extraction on the document is abandoned. Compared with the traditional culture method, the method extracts more accurately, quickly and conveniently.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and system for extracting malicious code samples based on document-type vulnerabilities. Background technique [0002] The malicious code based on the document type vulnerability is not initially in the user's computer, but the intruder first implants the vulnerable document into the user's computer in various ways, and then guides the user to open the operation, so that through the set shellcode Release or download of malicious code. And these malicious codes often go through layers of anti-information security product operations by intruders: packing, anti-virtual machine, anti-kill, driver protection, conditional execution and other protections. The most important problem is that intruders often know very well about the users or networks to be invaded, and their purpose is to only steal specific user information, and to carry out long-term latency, so intrud...

AI Technical Summary

Problems solved by technology

[0004] First, when a large number of documents are executed in a virtual machine, each of them must have a running and waiting time, so the operation speed is very slow;

[0005] Second, different types of documents depend on the operating environment of the document when they are executed, so the construction of the operating environment in the virtual machine is a time-consuming process, and the operating environment may not include all document execution environments, so that As a result, some documents cannot be executed because there is no operating environment;

[0006] Third, the captured samples have been protected by intruders and conditionally executed, and there is basically no behavior in the automatic analysis of virtual machines, so it is difficult to determine whether they are malicious or not

Images