System and method for characterizing malware
AssigneeTrap Data Security Ltd.
InventorsYuval MALACHI, Mori Benech
Life of this patent
Estimating the term…
Abstract
An embodiment may create a memory image including a representation of a thread environment block (TEB) and representation of a process environment block (PEB) according to specifications of an operating system. A memory image may be loaded into a memory and a shellcode may be caused to use the memory image when executed. An access to the memory image, made by the shellcode, may be monitored and controlled.
Claims20
A computer-implemented method for executing a shellcode in a controlled environment, the method comprising:
- creating, in a memory of a computing device, a representation of a Thread Environment Block (TEB) and a Process Environment Block (PEB) according to specifications of an operating system (OS);
- generating a representation of a set of Dynamic-link libraries (DLLs) by analyzing a set of DLLs wherein the representation includes at least an address and a name of at least one DLL;
- loading the representations into the memory at a location according to a Local Descriptor Table (LDT);
- loading a shellcode into the memory and causing a controller to execute the shellcode;
- and
- controlling access, by the shellcode, to the representation of the set of DLLs.
A computer-implemented method for generating a memory representation, the method comprising:
- creating, in a memory image:
- a representation of a Thread Environment Block (TEB) and a Process Environment Block (PEB) according to specifications of an operating system (OS), and
- a representation of a set of Dynamic-link libraries (DLLs);
- loading the memory image to a location pointed by a Local Descriptor Table (LDT);
- executing the shellcode;
- and
- monitoring accesses, made by the shellcode, to the representation of the set of DLLs.
A system comprising:
- a memory;
- and
- a controller, the controller configured to:
- create, in a memory of a computing device, a representation of a Thread Environment Block (TEB) and a Process Environment Block (PEB) according to specifications of an operating system (OS);
- generate a representation of a set of Dynamic-link libraries (DLLs) by analyzing a set of DLLs wherein the representation includes at least an address and a name of at least one DLL;
- load the representations into the memory at a location pointed by a Local Descriptor Table (LDT);
- load a shellcode into the memory and cause a controller to execute the shellcode;
- and
- control access, by the shellcode, to the representation of the set of DLLs.
Dependencies are inferred from the claim text.