In-memory scan for threat detection with binary instrumentation backed generic unpacking, decryption, and deobfuscation

A non-transitory computer-readable medium having instructions stored thereon for programming one or more processors, associated with a sandbox, to perform steps of:

• responsive to receiving unknown content, scanning an image of the unknown content for packed, obfuscated, or encrypted code;
• responsive to detecting the packed, obfuscated, or encrypted code performing steps of:
• unpacking, deobfuscating, or decrypting the packed, obfuscated, or encrypted code in memory using an in-memory unpacking and deobfuscation scanner configured to defeat anti-sandbox evasion techniques;
• executing the unpacked, deobfuscated, or decrypted code;
• monitoring execution of the unpacked, deobfuscated, or decrypted code including monitoring memory allocations, permission changes, spawned child process, process injections, and associated system calls;
• obtaining events comprising behavioral evens, system calls, and memory events, the events including artifacts collected prior to cleanup of allocated memory regions;
• and
• providing the obtained events to the sandbox for use in a sandbox analysis, wherein the sandbox analysis includes adjusting a malware classification score based on the obtained events to classify the unknown content as one of malware and clean.