# US 12,223,044 B1 · Identifying malware based on system API function pointers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,044 B1 - Document ID: US12223044B1 - Status: Granted - Kind: B1 - Application number: 17/373,415 - Filed: 2021-07-12 - Granted: 2025-02-11 - Earliest claimed: 2021-07-12 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Robert Jung; Daniel Raygoza; Michael S. Hughes; Esmid Idrizovic - Web page: https://patentgrep.com/patent/US12223044B1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/564: {by virus signature recognition} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques for identifying malware based on system API function pointers are disclosed. In some embodiments, a system/process/computer program product for identifying malware based on system API function pointers includes monitoring changes in memory during execution of a malware sample in a computing environment; detecting a dynamic evasion behavior using an Application Programming Interface (API) vector comprising a plurality of system API function pointers identified in the memory during execution of the malware sample in the computing environment; and generating a signature based on the API vector for automatically detecting the malware during execution in the memory, wherein the malware sample was determined to be malicious. ## Claims ### Claim 1 A system, comprising: a processor configured to: monitor changes in a memory during execution of a malware sample in a computing environment to obtain an Application Programming Interface (API) vector, comprising to: compare an initial snapshot of all of a plurality of pages in the memory associated with a process of the malware sample with a final snapshot of all of the plurality of pages in the memory associated with the process of the malware sample in the computing environment to identify first system API function pointers; order the first system API function pointers to obtain ordered first system API function pointers, wherein the first system API function pointers are ordered based on an order in which the first system API function pointers are stored in the memory; identify second system API function pointers in the memory prior to the execution of the malware sample to obtain identified second system API function pointers; and filter the identified second system API function pointers from the ordered first system API function pointers to generate the API vector; detect a dynamic evasion behavior using the API vector, comprising to: generate a classifier based on the API vector, wherein the first system API function pointers were dynamically generated during the execution of the malware sample in the computing environment; and generate a signature based on the API vector, wherein the malware sample was determined to be malicious; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein the dynamic evasion behavior includes an unpacking behavior during execution of the malware sample. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the computing environment comprises a virtual machine instance. ### Claim 4 (depends on 1) The system recited in claim 1, wherein an output of the monitored changes in the memory after a system call event during execution of the malware sample for a predetermined period of time in the computing environment is reassembled and analyzed to identify a potential malware binary, and wherein the potential malware binary is submitted for dynamic analysis and/or static analysis. ### Claim 5 (depends on 1) The system recited in claim 1, wherein a plurality of pages in the memory associated with a process launched by executing the malware sample are identified and monitored for changes after one or more system call events during execution of the malware sample for a predetermined period of time in the computing environment. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: detect a dynamically generated function pointer in the memory based on an analysis of the monitored changes in the memory during execution of the malware sample in the computing environment. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: parse offsets to determine locations of the plurality of system API function pointers to generate the API vector. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: automatically generate the signature using a hash of the API vector. ### Claim 9 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: automatically generate the signature using a fuzzy hash of the API vector. ### Claim 10 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: store the API vector in an API vector data store; and input the API vector into a classifier for automatic malware detection using the API vector. ### Claim 11 (depends on 1) The system recited in claim 1, wherein a plurality of pages in the memory associated with a process launched by executing the malware sample are identified and monitored for changes during execution of the malware sample in the computing environment, and wherein the processor is further configured to: maintain a list of memory locations of accessible system functions; search the memory for the list of memory locations; periodically search the memory after predetermined execution events to detect any memory pointers in the memory; filter the memory locations where pointers to the system functions were detected in the memory to generate a set of system API function pointers; and automatically analyze the set of system API function pointers to determine whether the malware sample attempted to obfuscate suspicious or malicious nehavior. ### Claim 12 A method, comprising: monitoring changes in memory during execution of a malware sample in a computing environment to obtain an Application Programming Interface (API) vector, comprising: comparing an initial snapshot of all of a plurality of pages in the memory associated with a process of the malware sample with a final snapshot of all of the plurality of pages in the memory associated with the process of the malware sample in the computing environment to identify first system API function pointers; ordering the first system API function pointers to obtain ordered first system API function pointers, wherein the first system API function pointers are ordered based on an order in which the first system API function pointers are stored in the memory; identifying second system API function pointers in the memory prior to the execution of the malware sample to obtain identified second system API function pointers; and filtering the identified second system API function pointers from the ordered first system API function pointers to generate the API vector; detecting a dynamic evasion behavior using the API vector, comprising: generating a classifier based on the API vector, wherein the first system API function pointers were dynamically generated during the execution of the malware sample in the computing environment; and generating a signature based on the API vector, wherein the malware sample was determined to be malicious. ### Claim 13 (depends on 12) The method of claim 12, wherein the computing environment comprises a virtual machine instance. ### Claim 14 A tangible non-transitory computer readable storage medium comprising computer instructions for: monitoring changes in memory during execution of a malware sample in a computing environment to obtain an Application Programming Interface (API) vector, comprising: comparing an initial snapshot of all of a plurality of pages in the memory associated with a process of the malware sample with a final snapshot of all of the plurality of pages in the memory associated with the process of the malware sample in the computing environment to identify first system API function pointers; ordering the first system API function pointers to obtain ordered first system API function pointers, wherein the first system API function pointers are ordered based on an order in which the first system API function pointers are stored in the memory; identifying second system API function pointers in the memory prior to the execution of the malware sample to obtain identified second system API function pointers; and filtering the identified second system API function pointers from the ordered first system API function pointers to generate the API vector; detecting a dynamic evasion behavior using the API vector, comprising: generating a classifier based on the API vector, wherein the first system API function pointers were dynamically generated during the execution of the malware sample in the computing environment; and generating a signature based on the API vector, wherein the malware sample was determined to be malicious. ### Claim 15 A system, comprising: a processor configured to: monitor changes in a memory during execution of a malware sample in a computing environment to obtain an Application Programming Interface (API) vector, comprising to: compare an initial snapshot of all of a plurality of pages in the memory associated with a process of the malware sample with a final snapshot of all of the plurality of pages in the memory associated with the process of the malware sample in the computing environment to identify first system API function pointers; order the first system API function pointers to obtain ordered first system API function pointers, wherein the first system API function pointers are ordered based on an order in which the first system API function pointers are stored in the memory; identify second system API function pointers in the memory prior to the execution of the malware sample to obtain identified second system API function pointers; and filter the identified second system API function pointers from the ordered first system API function pointers to generate the API vector; detect a dynamic evasion behavior using the API vector, comprising to: generate a classifier based on the API vector, wherein the first system API function pointers were dynamically generated during the execution of the malware sample in the computing environment; and perform a signature match of the API vector, wherein the malware sample was determined to be malicious; and a memory coupled to the processor and configured to provide the processor with instructions.