A Dynamic Analysis Method for Executable Programs Missing in Dynamic Link Libraries

Abstract

The invention provides a dynamic analysis method for a dynamic link library-missed executable program. The method comprises the steps of analyzing an import table of the executable program, and acquiring a dynamic link library imported by the import table and the information of an import function corresponding to the import table; then modifying a pre-compiled export table which exports seed DLL files of a plurality of functions so that the export table exports the import function needed by a to-be-analyzed sample program, and modifying the name of the DLL so that the name of the DLL corresponds to the name of the DLL needed by the sample program; and finally generating a program sample-dependent external dynamic link library file so as to realize dynamic analysis for the dynamic link library-missed executable program. According to the dynamic analysis method, the executable program does not need to run, the executable program is not modified, the completeness of the executable program is not destroyed; and meanwhile, the method is not only suitable for the dynamic analysis of the executable program but also suitable for the dynamic analysis of a dynamic link library file, and is especially suitable for the dynamic analysis of malicious software.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a dynamic analysis method for an executable program missing in a dynamic link library. Background technique [0002] With the continuous development of computer technology and Internet technology, every aspect of people's life is increasingly inseparable from computers and the software running on them. Malware steals personal data and business secrets, sends spam, controls users' computers, and launches denial-of-service attacks on remote servers, causing serious distress and economic losses to individuals and businesses. To evade detection, malware often hides among many harmless programs. To detect and remove malware from a large number of executable program samples, it is first necessary to obtain the basic information and program behavior of executable program samples, and extract and summarize the characteristics of malware from them. Executable progra...

AI Technical Summary

Problems solved by technology

However, this method needs to modify the import table and PE header structure of the program sample, which destroys the integrity of the program sample. If the program sample has a self-verification function, when it detects that it has been modified, it may run abnormally or If the operation is terminated directly, the analysis platform will not be able to obtain various behaviors of the program sample during normal operation

Images