Packed Executable Unpacking for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus software is ineffective in detecting and preventing packed malware, as it relies on pattern matching and fails to recognize superficially modified malware, leading to costly and inefficient constant updates for signature recognition.
Innovation Solution
A system comprising a malware evaluator and an unpacking module that intercepts incoming data, identifies packed executables, and unpacks them without execution, using a set of unpacker modules to generate an unpacked executable for evaluation, allowing for determination of malware presence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-virus software uses pattern matching to detect known malware, then it can prevent known malware from reaching the computer, but it fails to detect packed malware that has been superficially modified
Solution Approach 1:
The system performs preliminary unpacking of packed executables before malware detection. The unpacking module extracts the original code from packed formats (such as UPX, PECompact, AsPack) so that the malware evaluator can analyze the true malware signature rather than the obfuscated packed version, enabling detection of modified malware that would otherwise evade pattern matching.
Solution Approach 2:
The unpacking module serves as an intermediary between the packed executable and the malware evaluator. It translates the packed format into the original executable format, allowing the malware evaluator to work with the actual malware code rather than its obfuscated representation, thus bridging the gap between detection capability and adapted malware variants.
2Productivity
If anti-virus software relies on signature patterns for malware detection, then it can efficiently block known malware, but it requires constant updates to recognize new variations
Solution Approach 1:
The system performs preliminary unpacking of packed executables before malware detection. The unpacking module extracts the original code from packed formats (such as UPX, PECompact, AsPack) so that the malware evaluator can analyze the true malware signature rather than the obfuscated packed version, enabling detection of modified malware that would otherwise evade pattern matching.
Solution Approach 2:
The unpacking module creates a copy of the packed executable's internal structure to extract and reconstruct the original code. This copying process allows the system to work with a representation of the true malware without modifying the original packed file, enabling efficient detection while maintaining the ability to block known malware through signature matching.
3Reliability
If the system unpacks packed executables for evaluation, then it can detect packed malware, but it increases system complexity
Solution Approach 1:
The system divides the unpacking functionality into separate, specialized modules, each handling a specific packed format (UPX, PECompact, AsPack). This segmentation allows the malware evaluator to maintain a clean architecture while the unpacking modules handle the complexity of format-specific extraction and reconstruction, isolating complexity rather than increasing overall system complexity.
Solution Approach 2:
The unpacking module is designed as a universal component that can handle multiple packed formats through a common interface. This multi-functionality allows the system to detect various types of packed malware using a single unified module structure, reducing complexity compared to having separate detection mechanisms for each packed format.
Data Source
AI summary
A system and method for determining whether a packed executable is malware is presented. In operation, a malware evaluator intercepts incoming data directed to a computer. The malware evaluator evaluates the incoming data to determine whether the incoming data is a packed executable. If the incoming data is a packed executable, the malware evaluator passes the packed executable to an unpacking module. The unpacking module includes a set of unpacker modules for unpacking a packed executable of a particular type. The unpacking module selects an unpacker module according to the type of the packed executable, and executes the selected unpacker module. Executing the unpacker module generates an unpacked executable corresponding to the packed executable. The unpacked executable is returned to the malware evaluator where it is evaluated to determine whether the packed executable is malware.