# US 10,275,595 B2 · System and method for characterizing malware

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,275,595 B2
- Document ID: US10275595B2
- Status: Granted
- Kind: B2
- Application number: 15/279,471
- Filed: 2016-09-29
- Published: 2018-03-29
- Granted: 2019-04-30
- Earliest claimed: 2016-09-29
- Assignees: Trap Data Security Ltd.
- Applicants: Trap Data Security Ltd.
- Inventors: Yuval Malachi; Mori Benech
- Web page: https://patentgrep.com/patent/US10275595B2

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 9/44521: {Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading}
- G06F 9/45512: {Command shells}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 2221/033: Test or assess software
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

An embodiment may create a memory image including a representation of a thread environment block (TEB) and representation of a process environment block (PEB) according to specifications of an operating system. A memory image may be loaded into a memory and a shellcode may be caused to use the memory image when executed. An access to the memory image, made by the shellcode, may be monitored and controlled.

## Claims

### Claim 1

A computer-implemented method for executing a shellcode in a controlled environment, the method comprising:
creating, in a memory of a computing device, a Process Environment Block (PEB) according to specifications of an operating system (OS);
generating a representation of a set of Dynamic-link libraries (DLLs) by analyzing a set of DLLs wherein the representation of the set of DLLs includes at least an address and a name of at least one DLL;
loading the representations of the set of DLLs into the memory at a location according to a Local Descriptor Table (LDT);
loading a shellcode into the memory and causing a controller to execute the shellcode;
controlling access, by the shellcode, to the representation of the set of DLLs; and
accelerating access, made by the shellcode, to the representation of the set of DLLs, by including only a predefined small set of DLLs descriptors in the PEB wherein the small set is defined based on identifying DLLs typically called by a shellcode.

### Claim 2 (depends on 1)

The method of claim 1, comprising randomizing addresses in the PEB by randomly ordering DLLs descriptors in the PEB.

### Claim 3 (depends on 1)

The method of claim 1, wherein an OS used by the computing device is different from an OS targeted by the shellcode.

### Claim 4 (depends on 1)

The method of claim 1, wherein the representation of the DLL's includes only metadata related to the DLL's and does not include actual executable code.

### Claim 5 (depends on 1)

The method of claim 1, wherein the representation of a DLL includes custom executable code designed to trigger an action when the DLL is called.

### Claim 6 (depends on 1)

The method of claim 1, comprising generating the representation of the DLLs based on at least one of: a type of an OS, a set of DLLs, a memory address of a DLL.

### Claim 7 (depends on 1)

The method of claim 1, comprising randomizing, in the representation of the DLL's, at least one of: addresses of DLLs and the order of functions included in DLLs.

### Claim 8 (depends on 1)

The method of claim 1, comprising creating, in the memory, a representation of a Thread Environment Block (TEB), wherein the representations of the TEB, PEB and DLLs is aggregated into one portable, small, lightweight, memory representation and wherein the portable light memory representation is loaded into the memory.

### Claim 9

A computer-implemented method for generating a memory representation, the method comprising:
creating, in a memory image:
a representation of a Process Environment Block (PEB) according to specifications of an operating system (OS), and
a representation of a set of Dynamic-link libraries (DLLs), wherein the representation of the set of DLLs includes at least an address and a name of at least one DLL;
loading the memory image to a location pointed by a Local Descriptor Table (LDT);
executing the shellcode;
monitoring accesses, made by the shellcode, to the representation of the set of DLLs; and
accelerating access, made by the shellcode, to the representation of the set of DLLs, by including only a predefined small set of DLLs descriptors in the PEB wherein the small set is defined based on identifying DLLs typically called by a shellcode.

### Claim 10

A system comprising:
a memory; and
a controller, the controller configured to:
create, in a memory of a computing device, a representation of a Process Environment Block (PEB) according to specifications of an operating system (OS);
generate a representation of a set of Dynamic-link libraries (DLLs) by analyzing a set of DLLs wherein the representation includes at least an address and a name of at least one DLL;
load the representation of the set of DLLs into the memory at a location pointed by a Local Descriptor Table (LDT);
load a shellcode into the memory and cause a controller to execute the shellcode;
control access, by the shellcode, to the representation of the set of DLLs; and
accelerate access, made by the shellcode, to the representation of the set of DLLs, by including only a predefined small set of DLLs descriptors in the PEB wherein the small set is defined based on identifying DLLs typically called by a shellcode.

### Claim 11 (depends on 10)

The system of claim 10, wherein the controller is further to randomizing addresses in the PEB by randomly ordering DLLs descriptors in the PEB.

### Claim 12 (depends on 10)

The system of claim 10, wherein an OS used by the controller is different from an OS targeted by the shellcode.

### Claim 13 (depends on 10)

The system of claim 10, wherein the representation of the DLL's includes only metadata related to the DLL's and does not include actual executable code.

### Claim 14 (depends on 10)

The system of claim 10, wherein the representation of a DLL includes custom executable code designed to trigger an action when the DLL is called.

### Claim 15 (depends on 10)

The system of claim 10, wherein the controller is further to configured to generate the representation of the DLLs based on at least one of: a type of an OS, a set of DLLs, a memory address of a DLL.

### Claim 16 (depends on 10)

The system of claim 10, wherein the controller is further to configured to randomizing, in at least one of the representations, at least one of:
addresses of DLLs and the order of functions included in DLLs.

### Claim 17 (depends on 10)

The system of claim 10, comprising creating, in the memory, a representation of a Thread Environment Block (TEB), wherein the representations of the TEB, PEB and DLLs is aggregated into one portable light memory representation and wherein the portable light memory representation is loaded into the memory.

### Claim 18 (depends on 10)

The system of claim 10, comprising creating, in the memory, a representation of a Thread Environment Block (TEB) and generating a set of light memory representations of the TEB, PEB and DLLs based on behaviors of a respective set of malwares.