Automated generation of a sandbox configuration for malware detection

A non-transitory computer readable storage medium storing instructions for automatically generating a blacklist for a sandbox application, the instructions when executed by one or more processors causing the one or more processors to perform steps comprising:

• obtaining a set of disassembled operating system dynamic-link libraries;
• identifying, in the disassembled operating system dynamic-link libraries, a set of API functions;
• identifying, from the set of API functions, a subset of API functions the subset of API functions including instructions that cause kernel interrupts;
• storing the identified subset of API functions having the instructions that cause kernel interrupts to an interrupt list;
• generating, by a processor device, based on the interrupt list, the blacklist that includes for each of the disassembled operating system dynamic-link libraries, the identified API functions in the interrupt list, all API functions that directly invoke one of the identified API functions in the interrupt list, and all API functions that indirectly invokes one of the identified API functions in the interrupt list via one or more nested API functions, wherein generating the blacklist comprises:
• identifying an initial set of API functions in the disassembled operating system dynamic-link libraries that each invokes one of the identified API functions in the interrupt list;
• and
• performing a plurality of iterative updates to the blacklist, wherein performing each iteration comprises:
• identifying at least one additional API function not on the blacklist that calls one of the API functions on the blacklist;
• and
• adding the at least one additional API function to the blacklist;
• and
• outputting the blacklist to the sandbox application, wherein the sandbox application operates on a sample file to emulate API functions of the sample file that match the blacklist.

A computer system comprising:

• one or more processors;
• and
• a non-transitory computer readable storage medium storing instructions for automatically generating a blacklist for a sandbox application, the instructions when executed by one or more processors causing the one or more processors to perform steps comprising:
• obtaining a set of disassembled operating system dynamic-link libraries;
• identifying, in the disassembled operating system dynamic-link libraries, a set of API functions;
• identifying, from the set of API functions, a subset of API functions the subset of API functions including instructions that cause kernel interrupts;
• storing the identified subset of API functions having the instructions that cause kernel interrupts to an interrupt list;
• generating, by a processor device, based on the interrupt list, the blacklist that includes for each of the disassembled operating system dynamic-link libraries, the identified API functions in the interrupt list, all API functions that directly invoke one of the identified API functions in the interrupt list, and all API functions that indirectly invokes one of the identified API functions in the interrupt list via one or more nested API functions, wherein generating the blacklist comprises:
• identifying an initial set of API functions in the disassembled operating system dynamic-link libraries that each invokes one of the identified API functions in the interrupt list;
• and
• performing a plurality of iterative updates to the blacklist, wherein performing each iteration comprises:
• identifying at least one additional API function not on the blacklist that calls one of the API functions on the blacklist;
• and
• adding the at least one additional API function to the blacklist;
• and
• outputting the blacklist to the sandbox application, wherein the sandbox application operates on a sample file to emulate API functions of the sample file that match the blacklist.