Identifying malware based on system API function pointers

A method, comprising:

• monitoring changes in memory during execution of a malware sample in a computing environment to obtain an Application Programming Interface (API) vector, comprising:
• comparing an initial snapshot of all of a plurality of pages in the memory associated with a process of the malware sample with a final snapshot of all of the plurality of pages in the memory associated with the process of the malware sample in the computing environment to identify first system API function pointers;
• ordering the first system API function pointers to obtain ordered first system API function pointers, wherein the first system API function pointers are ordered based on an order in which the first system API function pointers are stored in the memory;
• identifying second system API function pointers in the memory prior to the execution of the malware sample to obtain identified second system API function pointers;
• and
• filtering the identified second system API function pointers from the ordered first system API function pointers to generate the API vector;
• detecting a dynamic evasion behavior using the API vector, comprising:
• generating a classifier based on the API vector, wherein the first system API function pointers were dynamically generated during the execution of the malware sample in the computing environment;
• and
• generating a signature based on the API vector, wherein the malware sample was determined to be malicious.

A tangible non-transitory computer readable storage medium comprising computer instructions for:

• monitoring changes in memory during execution of a malware sample in a computing environment to obtain an Application Programming Interface (API) vector, comprising:
• comparing an initial snapshot of all of a plurality of pages in the memory associated with a process of the malware sample with a final snapshot of all of the plurality of pages in the memory associated with the process of the malware sample in the computing environment to identify first system API function pointers;
• ordering the first system API function pointers to obtain ordered first system API function pointers, wherein the first system API function pointers are ordered based on an order in which the first system API function pointers are stored in the memory;
• identifying second system API function pointers in the memory prior to the execution of the malware sample to obtain identified second system API function pointers;
• and
• filtering the identified second system API function pointers from the ordered first system API function pointers to generate the API vector;
• detecting a dynamic evasion behavior using the API vector, comprising:
• generating a classifier based on the API vector, wherein the first system API function pointers were dynamically generated during the execution of the malware sample in the computing environment;
• and
• generating a signature based on the API vector, wherein the malware sample was determined to be malicious.

A system, comprising:

• a processor configured to:
• monitor changes in a memory during execution of a malware sample in a computing environment to obtain an Application Programming Interface (API) vector, comprising to:
• compare an initial snapshot of all of a plurality of pages in the memory associated with a process of the malware sample with a final snapshot of all of the plurality of pages in the memory associated with the process of the malware sample in the computing environment to identify first system API function pointers;
• order the first system API function pointers to obtain ordered first system API function pointers, wherein the first system API function pointers are ordered based on an order in which the first system API function pointers are stored in the memory;
• identify second system API function pointers in the memory prior to the execution of the malware sample to obtain identified second system API function pointers;
• and
• filter the identified second system API function pointers from the ordered first system API function pointers to generate the API vector;
• detect a dynamic evasion behavior using the API vector, comprising to:
• generate a classifier based on the API vector, wherein the first system API function pointers were dynamically generated during the execution of the malware sample in the computing environment;
• and
• perform a signature match of the API vector, wherein the malware sample was determined to be malicious;
• and
• a memory coupled to the processor and configured to provide the processor with instructions.