Rendering an object using muliple versions of an application in a single process for dynamic malware analysis

A method, comprising:

• receiving a sample at a cloud security service for detonating in an instrumented virtual machine environment wherein the sample includes an embedded object;
• modifying the instrumented virtual machine environment to support execution of a plurality of versions of an application, wherein modifying the instrumented virtual machine environment to support execution of the plurality of versions of the application comprises one or more of the following to facilitate co-rendering of the embedded object using the plurality of versions of the application:
• hot patching a baseline virtual machine image to add a new class identifier (ID) and a type for each of the plurality of versions of the application in a registry;
• and
• modifying a physical executable file for each of the plurality of versions of the application;
• detonating the sample using a browser executed in the instrumented virtual machine environment;
• and
• rendering the embedded object included in the sample using the plurality of versions of the application in a single process for executing the browser during a dynamic malware analysis using the instrumented virtual machine environment, wherein the application is an external application that is called by the browser to render the embedded object included in the sample.

A computer program product, the computer program product being embodied in a non-transitory, tangible computer readable storage medium and comprising computer instructions for:

• receiving a sample at a cloud security service for detonating in an instrumented virtual machine environment wherein the sample includes an embedded object;
• modifying the instrumented virtual machine environment to support execution of a plurality of versions of an application, wherein modifying the instrumented virtual machine environment to support execution of the plurality of versions of the application comprises one or more of the following to facilitate co-rendering of the embedded object using the plurality of versions of the application:
• hot patching a baseline virtual machine image to add a new class identifier (ID) and a type for each of the plurality of versions of the application in a registry;
• and
• modifying a physical executable file for each of the plurality of versions of the application;
• detonating the sample using a browser executed in the instrumented virtual machine environment;
• and
• rendering the embedded object included in the sample using the plurality of versions of the application in a single process for executing the browser during a dynamic malware analysis using the instrumented virtual machine environment, wherein the application is an external application that is called by the browser to render the embedded object included in the sample.