Emulation-Based Detection of Unknown Packers and Cryptors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional detection methods are ineffective in identifying unknown packers and cryptors used to conceal malicious software, as they compress, encrypt, and modify executable files, evading antivirus detection.
Innovation Solution
The system emulates the execution of software objects modified by unknown packers or cryptors, collects and combines memory operations, identifies high-level operations associated with unpacking or decryption, and generates records to detect these entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional detection methods are used to scan executable files, then detection speed is maintained, but detection accuracy deteriorates because packers and cryptors conceal malicious code through compression and encryption
Solution Approach 1:
The system performs preliminary emulation of the packed/encrypted executable in a sandbox environment before actual detection. The emulation phase executes the code in a controlled setting to capture its behavior patterns, memory operations, and API calls, which are then used as the basis for detection. This preliminary action transforms the detection approach from static analysis to dynamic behavioral analysis, enabling accurate identification of malicious code even when concealed by packers or cryptors.
Solution Approach 2:
The system introduces an intermediary emulation layer between the suspicious executable and the detection engine. Instead of directly analyzing the packed/encrypted code, the system uses the emulation environment as a mediator to observe the code's actual behavior when executed. This intermediary approach allows the detection system to see through the obfuscation techniques used by packers and cryptors by monitoring what the code actually does rather than how it appears.
2Measurement precision
If emulation is used to analyze packed and encrypted executables, then detection accuracy improves by identifying behavioral patterns, but processing time increases
Solution Approach 1:
The system applies partial emulation by focusing on specific critical sections of the executable code rather than emulating the entire program. The emulation is directed toward capturing key behavioral patterns such as memory allocation patterns, API call sequences, and decryption routines. By concentrating emulation resources on the most informative parts of the code, the system achieves sufficient detection accuracy without the prohibitive time cost of complete emulation.
Solution Approach 2:
The detection process is segmented into distinct phases: initial emulation to capture behavioral patterns, analysis of captured patterns, and comparison against known malicious signatures. The emulation itself is segmented to focus on critical code sections that reveal packer/cryptor behavior. This segmentation allows the system to process executables more efficiently by avoiding unnecessary emulation of non-critical code portions.
3Measurement precision
If memory operations are collected and combined into sequential sets, then unknown packers and cryptors are identified, but data processing complexity increases
Solution Approach 1:
The system merges individual memory operations into sequential sets that represent complete unpacking or decryption processes. By combining related memory operations that occur in sequence during code execution, the system creates higher-level behavioral signatures that are characteristic of specific packers and cryptors. This merging process transforms raw, granular memory operation data into meaningful patterns that are easier to analyze and compare against known malicious techniques.
Solution Approach 2:
The system creates copies of memory operation sequences and stores them as reference patterns for comparison. Instead of analyzing each memory operation in isolation, the system replicates the sequence of operations as a template and compares future executions against these templates. This copying approach enables efficient pattern recognition and identification of unknown packers/cryptors by matching behavioral fingerprints without requiring complex real-time analysis of each individual operation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are systems, methods and computer program products for detecting unknown packers and cryptors. An example method comprises emulating execution of a software object modified by an unknown packer or cryptor (301); collecting information about memory operations performed during the emulation (303); combining information about a plurality of related memory operations (304) into at least one sequential set of memory operations; identifying from the at least one sequential set of related memory operations one or more high-level operations associated with unpacking or decryption of the emulated object (305); and generating based on the one or more high-level operations a record of the unknown packer or cryptor to be used for detecting the unknown packer or cryptor (306).