Extending dynamic detection of malware using static and dynamic malware analyses

A device, comprising:

• one or more memories;
• and
• one or more processors to:
• receive a software program from a client device;
• perform a dynamic malware analysis of the software program to generate dynamic malware analysis results;
• generate a call graph based on the dynamic malware analysis of the software program;
• utilize, during the dynamic malware analysis of the software program, the call graph to identify at least one of:
• an exit of the software program, or
• a forced kill of the software program;
• perform a static malware analysis of the software program based on identifying the at least one of the exit of the software program or the forced kill of the software program;
• generate static malware analysis results based on performing the static malware analysis of the software program;
• combine the dynamic malware analysis results and the static malware analysis results to generate combined malware analysis results;
• remove application programming interface (API) traces, provided in the combined malware analysis results, that are subsets of other API traces provided in the combined malware analysis results,
• wherein modified malware analysis results are generated based on removing the API traces that are subsets of other traces from the combined malware analysis results;
• and
• perform one or more actions based on the modified malware analysis results.

The device of claim 0, wherein, when performing the one or more actions, the one or more processors are to one or more of:

• modify the software program to remove malicious code and to generate a modified software program;
• provide the modified software program to the client device for execution;
• reanalyze the software program to verify that the malicious code has been removed from the software program;
• or
• remodify the software program to remove any remaining malicious code based on reanalyzing the software program.

The device of claim 0, wherein, when performing the one or more actions, the one or more processors are to one or more of:

• provide, to the client device, instructions that cause the client device to modify the software program to remove malicious code;
• provide, to the client device, instructions that cause the client device to report the software program and the malicious code to particular devices;
• report the software program and the malicious code to the particular devices;
• prevent the software program and the malicious code from being executed on the particular devices that include the software program and the malicious code;
• or
• remove the software program and malicious code from the particular devices that include the software program and the malicious code.

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the one or more processors to:
• receive a software program from a client device;
• perform a dynamic malware analysis of the software program to generate dynamic malware analysis results,
• wherein the dynamic malware analysis results include information identifying one or more application programming interface (API) traces provided in the software program;
• generate a call graph based on the dynamic malware analysis of the software program;
• utilize, during the dynamic malware analysis of the software program, the call graph to identify at least one of:
• an exit of the software program, or
• a forced kill of the software program;
• perform a static malware analysis of the software program based on identifying the at least one of the exit of the software program or the forced kill of the software program;
• generate static malware analysis results based on performing the static malware analysis of the software program,
• wherein the static malware analysis results include information identifying one or more additional API traces provided in the software program;
• combine the dynamic malware analysis results and the static malware analysis results to generate combined malware analysis results;
• identify malicious code in the software program based on the combined malware analysis results;
• and
• perform one or more actions based on identifying the malicious code in the software program.