Decrypting Malicious Scripts via Independent Function Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods are inadequate for efficiently decrypting unknown encrypted malicious scripts, particularly those using new encryption techniques, as they require extensive knowledge of the encryption scheme and are burdensome to implement for script languages like Microsoft Visual Basic Script.
Innovation Solution
A method that classifies malicious script encryption techniques into three types based on decryption function dependency on external codes, allowing for the extraction and execution of independent decryption functions to obtain decrypted scripts without complete emulation, using a lightweight emulator.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the emulation technique is used to decrypt malicious codes in binary files, then decrypted codes can be obtained by executing code in a virtual machine, but it is difficult to construct an emulator for scripts and a large load is required
Solution Approach 1:
The patent segments the decryption process into two distinct phases: (1) executing only the decryption routine in a controlled environment to obtain the decrypted malicious code, and (2) analyzing the decrypted code without full emulation. This segmentation allows avoiding the complexity of constructing a complete script emulator while still achieving reliable decryption.
Solution Approach 2:
The patent extracts and isolates the decryption routine from the rest of the malicious script, executing only this specific portion in a virtual machine environment. By taking out the decryption function separately, the system avoids the need to emulate the entire script environment, significantly reducing emulator construction complexity while maintaining decryption reliability.
2Reliability
If the X-raying technique is used to decrypt malicious codes, then all possible key values can be tried to find the correct decryption key, but it is difficult to apply to new unknown malicious codes
Solution Approach 1:
The patent enables the system to automatically analyze and execute the decryption routine present within the malicious script itself, rather than relying on external brute-force key guessing. The decryption function is self-contained in the malicious code, and the system leverages this self-service capability to decrypt the code without needing prior knowledge of encryption schemes, thereby improving both accuracy and adaptability.
3Reliability
If complete emulation is performed to decrypt malicious scripts, then all decrypted codes can be obtained, but a large load is required and it is difficult to construct an emulator for script languages
Solution Approach 1:
The patent applies partial action by executing only the necessary decryption routine rather than performing complete emulation of the entire malicious script. This partial execution approach obtains the decrypted code needed for analysis while avoiding the excessive computational load and complexity associated with full script environment emulation.
Data Source
AI summary
Disclosed herein is a method of analyzing and decrypting encrypted malicious scripts. The method of the present invention comprises the steps of classifying a malicious script encryption method into a case where a decryption function exists in malicious scripts and is an independent function that is not dependent on external codes such as run time library, a case where a decryption function exists and is a dependent function that is dependent on external codes, and a case where a decryption function does not exist; and if the decryption function exists in malicious scripts and is the independent function that is not dependent on the external codes, extracting a call expression and a function definition for the independent function, executing or emulating the extracted call expression and function definition for the independent function, and obtaining a decrypted script by putting a result value based on the execution or emulation into an original script at which an original call expression is located. According to the present invention, unknown malicious codes can be promptly and easily decrypted through only a single decryption algorithm without any additional data. In addition to the decryption of encrypted codes, complexity of later code analysis can also be reduced by substituting constants for all values that can be set as constants in a relevant script.