# US 10,482,239 B1 · Rendering an object using muliple versions of an application in a single process for dynamic malware analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,239 B1 - Document ID: US10482239B1 - Status: Granted - Kind: B1 - Application number: 15/199,875 - Filed: 2016-06-30 - Granted: 2019-11-19 - Earliest claimed: 2016-06-30 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Jiangxia Liu; Bo Qu; Tao Yan; Zhanglin He - Web page: https://patentgrep.com/patent/US10482239B1 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 21/563: {by source code analysis} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/0254: {Stateful filtering} - H04L 63/0263: {Rule management} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for rendering an object using multiple versions of an application in a single process for dynamic malware analysis are disclosed. In some embodiments, a system, process, and/or computer program product for rendering an object using multiple versions of an application in a single process for dynamic malware analysis includes receiving a sample at a cloud security service, in which the sample includes an embedded object; detonating the sample using a browser executed in an instrumented virtual machine environment; and rendering the embedded object using a plurality of versions of an application in a single process during a dynamic malware analysis using the instrumented virtual machine environment. ## Claims ### Claim 1 A system, comprising: a processor configured to: receive a sample at a cloud security service for detonating in an instrumented virtual machine environment wherein the sample includes an embedded object; modify the instrumented virtual machine environment to support execution of a plurality of versions of an application, wherein modifying the instrumented virtual machine environment to support execution of the plurality of versions of the application comprises one or more of the following to facilitate co-rendering of the embedded object using the plurality of versions of the application: hot patch a baseline virtual machine image to add a new class identifier (ID) and a type for each of the plurality of versions of the application in a registry; and modify a physical executable file for each of the plurality of versions of the application; detonate the sample using a browser executed in the instrumented virtual machine environment; and render the embedded object included in the sample using the plurality of versions of the application in a single process for executing the browser during a dynamic malware analysis using the instrumented virtual machine environment, wherein the application is an external application that is called by the browser to render the embedded object included in the sample; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein the sample is received from a security device that has a subscription to the cloud security service. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the sample is a Uniform Resource Locator (URL) sample. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the external application is different than the browser and is capable of rendering the embedded object. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the embedded object is rendered using the external application executed in the instrumented virtual machine environment, and wherein the external application corresponds to the application and is different than the browser executed in the instrumented virtual machine environment. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for at least a period of time allocated for performing the dynamic malware analysis of the sample or until malicious behavior is detected. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the sample includes a Uniform Resource Identifier (URI) that includes a reference to the embedded object that can be retrieved and rendered using the external application executed in the instrumented virtual machine environment. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the sample includes a Uniform Resource Identifier (URI) that includes a reference to the embedded object that can be retrieved and rendered using the external application executed in the instrumented virtual machine environment, and wherein the embedded object includes dynamic content. ### Claim 9 (depends on 1) The system recited in claim 1, wherein the sample includes a Uniform Resource Identifier (URI) that includes a reference to the embedded object that can be retrieved and rendered using the external application executed in the instrumented virtual machine environment, and wherein the embedded object includes content that includes Flash content. ### Claim 10 (depends on 1) The system recited in claim 1, wherein the sample includes a Uniform Resource Identifier (URI) that includes a reference to the embedded object that can be retrieved and rendered using the external application executed in the instrumented virtual machine environment, and wherein the embedded object includes content that includes PDF content. ### Claim 11 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: hot patch the baseline virtual machine image to add the new class ID and the type for each of the plurality of versions of the application in the registry to facilitate co-rendering of the embedded object using the plurality of versions of the application. ### Claim 12 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: launch a browser library in the single process executed in the instrumented virtual machine environment, wherein the browser library is loaded by the browser prior to rendering the sample, and wherein the browser library facilitates rendering the embedded object using the plurality of versions of the application in the single process during the dynamic malware analysis using the instrumented virtual machine environment. ### Claim 13 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: launch a browser plugin in the single process executed in the instrumented virtual machine environment, wherein the browser plugin is loaded by the browser prior to rendering the sample, and wherein the browser plugin facilitates rendering the embedded object using the plurality of versions of the application in the single process during the dynamic malware analysis using the instrumented virtual machine environment. ### Claim 14 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: launch a browser helper object (BHO) in the single process executed in the instrumented virtual machine environment, wherein the BHO is loaded by the browser prior to rendering the sample, and wherein the BHO facilitates rendering the embedded object using the plurality of versions of the application in the single process during the dynamic malware analysis using the instrumented virtual machine environment. ### Claim 15 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: determine that the sample is associated with malware based on the dynamic malware analysis using the instrumented virtual machine environment. ### Claim 16 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: determine whether the sample is associated with malware based on analysis of the sample during a period of time allocated for performing the dynamic malware analysis of the sample using the single process executed in the instrumented virtual machine environment. ### Claim 17 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: automatically generate a signature for the sample if the sample is determined to be malware. ### Claim 18 A method, comprising: receiving a sample at a cloud security service for detonating in an instrumented virtual machine environment wherein the sample includes an embedded object; modifying the instrumented virtual machine environment to support execution of a plurality of versions of an application, wherein modifying the instrumented virtual machine environment to support execution of the plurality of versions of the application comprises one or more of the following to facilitate co-rendering of the embedded object using the plurality of versions of the application: hot patching a baseline virtual machine image to add a new class identifier (ID) and a type for each of the plurality of versions of the application in a registry; and modifying a physical executable file for each of the plurality of versions of the application; detonating the sample using a browser executed in the instrumented virtual machine environment; and rendering the embedded object included in the sample using the plurality of versions of the application in a single process for executing the browser during a dynamic malware analysis using the instrumented virtual machine environment, wherein the application is an external application that is called by the browser to render the embedded object included in the sample. ### Claim 19 (depends on 18) The method of claim 18, wherein the sample is received from a security device that has a subscription to the cloud security service. ### Claim 20 (depends on 18) The method of claim 18, wherein the embedded object is rendered using the external application executed in the instrumented virtual machine environment, and wherein the external application corresponds to the application and is different than the browser executed in the instrumented virtual machine environment. ### Claim 21 (depends on 18) The method of claim 18, wherein the sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for at least a period of time allocated for performing the dynamic malware analysis of the sample or until malicious behavior is detected. ### Claim 22 (depends on 18) The method of claim 18, wherein the sample includes a Uniform Resource Identifier (URI) that includes a reference to the embedded object that can be retrieved and rendered using the external application executed in the instrumental virtual machine environment. ### Claim 23 (depends on 18) The method of claim 18, wherein the sample includes a Uniform Resource Identifier (URI) that includes a reference to the embedded object that can be retrieved and rendered using the external application executed in the instrumental virtual machine environment, and wherein the embedded object includes dynamic content, PDF content, or Flash content. ### Claim 24 (depends on 18) The method of claim 18, further comprising: launching a browser library in the single process executed in the instrumented virtual machine environment, wherein the browser library is loaded by the browser prior to rendering the sample, and wherein the browser library facilitates rendering the embedded object using the plurality of versions of the application in the single process during the dynamic malware analysis using the instrumented virtual machine environment. ### Claim 25 (depends on 18) The method of claim 18, further comprising: launching a browser plugin in the single process executed in the instrumented virtual machine environment, wherein the browser plugin is loaded by the browser prior to rendering the sample, and wherein the browser plugin facilitates rendering the embedded object using the plurality of versions of the application in the single process during the dynamic malware analysis using the instrumented virtual machine environment. ### Claim 26 (depends on 18) The method of claim 18, further comprising: launching a browser helper object (BHO) in the single process executed in the instrumented virtual machine environment, wherein the BHO is loaded by the browser prior to rendering the sample, and wherein the BHO facilitates rendering the embedded object using the plurality of versions of the application in the single process during the dynamic malware analysis using the instrumented virtual machine environment. ### Claim 27 (depends on 18) The method of claim 18, further comprising: determining whether the sample is associated with malware based on analysis of the sample during a period of time allocated for performing the dynamic malware analysis of the sample using the single process executed in the instrumented virtual machine environment. ### Claim 28 (depends on 18) The method of claim 18, further comprising: automatically generating a signature for the sample if the sample is determined to be malware. ### Claim 29 A computer program product, the computer program product being embodied in a non-transitory, tangible computer readable storage medium and comprising computer instructions for: receiving a sample at a cloud security service for detonating in an instrumented virtual machine environment wherein the sample includes an embedded object; modifying the instrumented virtual machine environment to support execution of a plurality of versions of an application, wherein modifying the instrumented virtual machine environment to support execution of the plurality of versions of the application comprises one or more of the following to facilitate co-rendering of the embedded object using the plurality of versions of the application: hot patching a baseline virtual machine image to add a new class identifier (ID) and a type for each of the plurality of versions of the application in a registry; and modifying a physical executable file for each of the plurality of versions of the application; detonating the sample using a browser executed in the instrumented virtual machine environment; and rendering the embedded object included in the sample using the plurality of versions of the application in a single process for executing the browser during a dynamic malware analysis using the instrumented virtual machine environment, wherein the application is an external application that is called by the browser to render the embedded object included in the sample. ### Claim 30 (depends on 29) The computer program product recited in claim 29, wherein the sample is received from a security device that has a subscription to the cloud security service. ### Claim 31 (depends on 29) The computer program product recited in claim 29, wherein the embedded object is rendered using the external application executed in the instrumented virtual machine environment, and wherein the external application corresponds to the application and is different than the browser executed in the instrumented virtual machine environment. ### Claim 32 (depends on 29) The computer program product recited in claim 29, wherein the sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for at least a period of time allocated for performing the dynamic malware analysis of the sample or until malicious behavior is detected. ### Claim 33 (depends on 29) The computer program product recited in claim 29, wherein the sample includes a Uniform Resource Identifier (URI) that includes a reference to the embedded object that can be retrieved and rendered using the external application executed in the instrumented virtual machine environment. ### Claim 34 (depends on 29) The computer program product recited in claim 29, wherein the sample includes a Uniform Resource Identifier (URI) that includes a reference to the embedded object that can be retrieved and rendered using the external application executed in the instrumented virtual machine environment, and wherein the embedded object includes dynamic content, PDF content, or Flash content. ### Claim 35 (depends on 29) The computer program product recited in claim 29, further comprising computer instructions for: launching a browser library in the single process executed in the instrumented virtual machine environment, wherein the browser library is loaded by the browser prior to rendering the sample, and wherein the browser library facilitates rendering the embedded object using the plurality of versions of the application in the single process during the dynamic malware analysis using the instrumented virtual machine environment. ### Claim 36 (depends on 29) The computer program product recited in claim 29, further comprising computer instructions for: launching a browser plugin in the single process executed in the instrumented virtual machine environment, wherein the browser plugin is loaded by the browser prior to rendering the sample, and wherein the browser plugin facilitates rendering the embedded object using the plurality of versions of the application in the single process during the dynamic malware analysis using the instrumented virtual machine environment. ### Claim 37 (depends on 29) The computer program product recited in claim 29, further comprising computer instructions for: launching a browser helper object (BHO) in the single process executed in the instrumented virtual machine environment, wherein the BHO is loaded by the browser prior to rendering the sample, and wherein the BHO facilitates rendering the embedded object using the plurality of versions of the application in the single process during the dynamic malware analysis using the instrumented virtual machine environment. ### Claim 38 (depends on 29) The computer program product recited in claim 29, further comprising computer instructions for: determining whether the sample is associated with malware based on analysis of the sample during a period of time allocated for performing the dynamic malware analysis of the sample using the single process executed in the instrumented virtual machine environment. ### Claim 39 (depends on 29) The computer program product recited in claim 29, further comprising computer instructions for: automatically generating a signature for the sample if the sample is determined to be malware.