Simulating user interactions for malware analysis
AssigneePalo Alto Networks, Inc.
InventorsBrandon R. Young, Daniel Raygoza, Sebas Sujeen Reymond Johnson, Abhiroop Dabral
Life of this patent
Estimating the term…
Abstract
Simulating user interactions during dynamic analysis of a sample is disclosed. A sample is received for analysis. Prior to execution of the sample, a baseline screenshot of a system folder is generated by accessing frame buffer data stored on a graphics card. The sample is caused to execute, at least in part using one or more hypervisor instructions to move a pointing device to an icon associated with the sample. A current screenshot of the system folder is generated by accessing current frame buffer data stored on the graphics card.
Claims31
A system, comprising:
- a processor configured to:
- receive a sample for analysis;
- generate, prior to execution of the sample, a baseline screenshot of a system folder by accessing frame buffer data stored on a graphics card;
- cause the sample to execute, at least in part by using one or more hypervisor instructions to move a pointing device to an icon associated with the sample;
- and
- generate a current screenshot of the system folder by accessing current frame buffer data stored on the graphics card;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving a sample for analysis;
- generating, prior to execution of the sample, a baseline screenshot of a system folder by accessing frame buffer data stored on a graphics card;
- causing the sample to execute, at least in part by using one or more hypervisor instructions to move a pointing device to an icon associated with the sample;
- and
- generating a current screenshot of the system folder by accessing current frame buffer data stored on the graphics card.
A non-transitory computer readable storage medium comprising computer instructions for:
- receiving a sample for analysis;
- generating, prior to execution of the sample, a baseline screenshot of a system folder by accessing frame buffer data stored on a graphics card;
- causing the sample to execute, at least in part by using one or more hypervisor instructions to move a pointing device to an icon associated with the sample;
- and
- generating a current screenshot of the system folder by accessing current frame buffer data stored on the graphics card.
Dependencies are inferred from the claim text.