US 11,797,676 B2 · Exception handlers in a sandbox environment for malware detection

Abstract

An anti-malware application can emulate a suspicious program in a sandbox environment and retrieve any exception handlers the suspicious program attempts to register with the operation system. When the suspicious program triggers an exception, the anti-malware application can save a current context of the suspicious program being emulated. To emulate the handling of the exception, the anti-malware application can validate an exception handler chain including one or more exception handlers added by the suspicious program. The anti-malware application can then select and emulate an exception handler based on the saved context of the suspicious program at the time the exception was triggered. If the first exception handler is successful at resolving the exception, the anti-malware application can then save an updated post-exception context and continue emulation of the suspicious program based on the result of the first exception handler.

Claims20

Dependent claims

A method comprising:

identifying, at a computing device, a suspicious program attempting to add an exception handler to an exception handler chain of the computing device,
in a sandbox environment that emulates the suspicious program, determining whether the suspicious program is a malicious program by:
generating a wrapped exception handler for the exception handler chain;
sequentially evaluating each exception handler in the exception handler chain with the wrapped exception handler by:
emulating an exception trigger for an exception handler in the exception handler chain;
evaluating the exception handler triggered by the emulated exception trigger;
responsive to evaluation of the exception handler indicating the suspicious program is non-malicious, evaluating a next exception handler in the exception handler chain;
and
responsive to evaluation of the exception handler indicating the suspicious program is malicious, classifying the suspicious program as the malicious program.

6 more elements

A non-transitory computer readable storage medium comprising instructions which, when executed by a processor, cause the processor to perform the steps of:

identifying, at a computing device, a suspicious program attempting to add an exception handler to an exception handler chain of the computing device,
in a sandbox environment that emulates the suspicious program, determining whether the suspicious program is a malicious program by:
generating a wrapped exception handler for the exception handler chain;
sequentially evaluating each exception handler in the exception handler chain with the wrapped exception handler by:
emulating an exception trigger for an exception handler in the exception handler chain;
evaluating the exception handler triggered by the emulated exception trigger;
responsive to evaluation of the exception handler indicating the suspicious program is non-malicious, evaluating a next exception handler in the exception handler chain;
and
responsive to evaluation of the exception handler indicating the suspicious program is malicious, classifying the suspicious program as the malicious program.

6 more elements

Dependencies are inferred from the claim text.

Exception handlers in a sandbox environment for malware detection

Life of this patent

Exception handlers in a sandbox environment for malware detection

Life of this patent

Abstract

Claims20