# US 12,602,467 B2 · In-memory scan for threat detection with binary instrumentation backed generic unpacking, decryption, and deobfuscation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,602,467 B2
- Document ID: US12602467B2
- Status: Granted
- Kind: B2
- Application number: 18/479,295
- Filed: 2023-10-02
- Published: 2024-01-25
- Granted: 2026-04-14
- Earliest claimed: 2020-01-30
- Assignees: Zscaler, Inc.
- Applicants: Zscaler, Inc.
- Inventors: Sandeep Paul; Sarthak Misraa; Deepen Desai
- Web page: https://patentgrep.com/patent/US12602467B2

## CPC

- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 2221/033: Test or assess software
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems and methods for in-memory malware unpacking and deobfuscation in a sandbox include, responsive to receiving unknown content, scanning an image of the unknown content for packed, obfuscated, or encrypted code; responsive to detecting the packed, obfuscated, or encrypted code performing steps of unpacking, deobfuscating, or decrypting the packed, obfuscated, or encrypted code; executing the unpacked, deobfuscated, or decrypted code; monitoring execution of the unpacked, deobfuscated, or decrypted code; obtaining events during the scanning and the execution; and providing the obtained events to the sandbox for use in a sandbox analysis for classifying the content as one of malware and clean.

## Claims

### Claim 1

A non-transitory computer-readable medium having instructions stored thereon for programming one or more processors, associated with a sandbox, to perform steps of:
responsive to receiving unknown content, scanning an image of the unknown content for packed, obfuscated, or encrypted code;
responsive to detecting the packed, obfuscated, or encrypted code performing steps of:
unpacking, deobfuscating, or decrypting the packed, obfuscated, or encrypted code in memory using an in-memory unpacking and deobfuscation scanner configured to defeat anti-sandbox evasion techniques;
executing the unpacked, deobfuscated, or decrypted code;
monitoring execution of the unpacked, deobfuscated, or decrypted code including monitoring memory allocations, permission changes, spawned child process, process injections, and associated system calls;
obtaining events comprising behavioral evens, system calls, and memory events, the events including artifacts collected prior to cleanup of allocated memory regions; and
providing the obtained events to the sandbox for use in a sandbox analysis, wherein the sandbox analysis includes adjusting a malware classification score based on the obtained events to classify the unknown content as one of malware and clean.

### Claim 2 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the steps further include:
responsive to not detecting the packed, obfuscated, or encrypted code, performing the sandbox analysis.

### Claim 3 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the unpacked, deobfuscated, or decrypted code is configured to execute on a time delay to avoid the classifying by the sandbox.

### Claim 4 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the monitoring includes detecting any spawned child processes and capturing the associated command-line arguments.

### Claim 5 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the monitoring includes detecting any process injection and generating a memory dump of injected payloads.

### Claim 6 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the monitoring includes detecting any system calls and Application Programming Interface (API) calls.

### Claim 7 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the events include a plurality of behavior based events, system calls, and memory events.

### Claim 8 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the events include (TTP) events and behavior events.

### Claim 9 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the steps further include:
running one or more rules on the events; and
providing results of the one or more rules to the sandbox.

### Claim 10 (depends on 1)

The non-transitory computer-readable medium of claim 1, wherein the adjusting the malware classification score is based on artifacts collected by the in-memory unpacking and deobfuscation scanner, the artifacts comprising freed memory regions, command in-line arguments of spawned child processes, and memory dumps of injected payloads.

### Claim 11

A method comprising steps of:
responsive to receiving unknown content, scanning an image of the unknown content for packed, obfuscated, or encrypted code;
responsive to detecting the packed, obfuscated, or encrypted code performing steps of:
unpacking, deobfuscating, or decrypting the packed, obfuscated, or encrypted code in memory using an in-memory unpacking and deobfuscation scanner configured to defeat anti-sandbox evasion techniques;
executing the unpacked, deobfuscated, or decrypted code;
monitoring execution of the unpacked, deobfuscated, or decrypted code including monitoring memory allocations, permission changes, spawned child process, process injections, and associated system calls;
obtaining events comprising behavioral evens, system calls, and memory events, the events including artifacts collected prior to cleanup of allocated memory regions; and
providing the obtained events to the sandbox for use in a sandbox analysis, wherein the sandbox analysis includes adjusting a malware classification score based on the obtained events to classify the unknown content as one of malware and clean.

### Claim 12 (depends on 11)

The method of claim 11, wherein the steps further include:
responsive to not detecting the packed, obfuscated, or encrypted code, performing the sandbox analysis.

### Claim 13 (depends on 11)

The method of claim 11, wherein the unpacked, deobfuscated, or decrypted code is configured to execute on a time delay to avoid the classifying by the sandbox.

### Claim 14 (depends on 11)

The method of claim 11, wherein the monitoring includes detecting any spawned child processes and capturing the associated command-line argument.

### Claim 15 (depends on 11)

The method of claim 11, wherein the monitoring includes detecting any process injection and generating a memory dump of injected payloads.

### Claim 16 (depends on 11)

The method of claim 11, wherein the monitoring includes detecting any system calls and Application Programming Interface (API) calls.

### Claim 17 (depends on 11)

The method of claim 11, wherein the events include a plurality of behavior based events, system calls, and memory events.

### Claim 18 (depends on 11)

The method of claim 11, wherein the events include (TTP) events and behavior events.

### Claim 19 (depends on 11)

The method of claim 11, wherein the steps further include:
running one or more rules on the events; and
providing results of the one or more rules to the sandbox.

### Claim 20 (depends on 11)

The method of claim 11, wherein the adjusting the malware classification score is based on artifacts collected by the in-memory unpacking and deobfuscation scanner, the artifacts comprising freed memory regions, command-line arguments of spawned child processes and memory dumps of injected payloads.