Methods and systems for performing a dynamic analysis of applications for protecting devices from malwares

A system for deep dynamic analysis for protecting endpoint devices from malware, comprising:

• at least one processor of a server of a safe isolated environment configured to:
• launch a deep analysis process, by a deep analysis tool of a server in a safe isolated environment, for determining whether a received sample of an application is a malware, the launching of the process including:
• injecting a dynamically loaded component into an address space of an application code and initializing, by the dynamically loaded component, to allow an execution activity;
• by the injected dynamically loaded component, parse dependencies of run-time linkages, hook system functions, create an initial application memory map with separate application and system code areas, patch an entry point back to the application code, and perform an on-sample-execution activity;
• unload and hide evidence of the injected dynamically loaded component by making a copy of a part of the injected dynamically loaded component that solely makes system calls to an operating system kernel of the server;
• obtain control of exception handler and monitors attempts to use the exception handler;
• by a registered exception handler, change an available area, log accesses, inspect exception reasons, and apply policies based on the exception reasons;
• analyze data related to the logged access and determine whether the application of the sample is a malware;
• and
• send, to the endpoint device, a final verdict indicating whether or not the application is a malware.

A non-transitory computer readable medium storing thereon computer executable instructions for deep dynamic analysis for protecting endpoint devices from malware, including instructions for:

• launching a deep analysis process, by a deep analysis tool of a server in a safe isolated environment, for determining whether a received sample of an application is a malware, the launching of the process including:
• injecting a dynamically loaded component into an address space of an application code and initializing, by the dynamically loaded component, to allow an execution activity;
• by the injected dynamically loaded component, parsing dependencies of run-time linkages, hooking system functions, creating an initial application memory map with separate application and system code areas, patching an entry point back to the application code, and performing an on-sample-execution activity;
• unloading and hiding evidence of the injected dynamically loaded component by making a copy of a part of the injected dynamically loaded component that solely makes system calls to an operating system kernel of the server;
• obtaining control of exception handler and monitoring attempts to use the exception handler;
• by a registered exception handler, changing an available area, logging accesses, inspecting exception reasons, and applying policies based on the exception reasons;
• analyzing data related to the logged access and determining whether the application of the sample is a malware;
• and
• sending, to the endpoint device, a final verdict indicating whether or not the application is a malware.