Back to results
US 2022/0035918 A1Published application
System and Method for Validating In-Memory Integrity of Executable Files to Identify Malicious Activity
AssigneeEndgame, Inc.
InventorJoseph W. Desimone
Life of this patent
Estimating the term…
Abstract
In the embodiments described herein, a malicious code detection module identifies potentially malicious instructions in volatile memory of a computing device before the instructions are executed. The malicious code detection module identifies an executable file, such as an .exe file, in memory, validates one or more components of the executable file against the same file stored in non-volatile storage, and issues an alert if the validation fails.
Claims22
A method of validating an executable file to identify potential malware in a computing device comprising a processor, memory, non-volatile storage, an operating system, and a malicious code detection module, the method comprising:
- identifying, by the malicious code detection module, a first executable file in the memory, the first executable file including:
- a first plurality of components that are not altered by the operating system when loaded into the memory;
- identifying, by the malicious code detection module, a second executable file in the non-volatile storage, wherein the first executable file and the second executable file are associated with one another by the operating system;
- determining that the second executable file has been compressed and/or encrypted using software packing;
- determining if the second executable file can be unpacked;
- unpacking the second executable file if the second executable file can be unpacked;
- comparing, by the malicious code detection module, a size of a first component of a first plurality of components of the first executable file and a size of a first component of the first plurality of components of the second executable file, wherein comparing includes accounting for changes to the second executable file caused by the unpacking of the second executable file, and further wherein when the second executable file has not been compressed and/or encrypted using software packing, the changes need not be accounted for, and
- generating an alert
- when the size of the first component of the first plurality of components of the first executable file and the size of the first component of the first plurality of components of the second executable file are different;
- wherein the first component of the first plurality of components of the first executable file is less than the entirety of the first executable file and the first component of the first plurality of components of the second executable file is less than the entirety of the second executable file.
7 more elements
A computing device comprising:
- a processor;
- memory;
- a non-volatile storage device;
- an operating system;
- and
- a malicious code detection module stored in the memory and executed by the processor, the malicious code detection module comprising instructions for:
- identifying a first executable file in the memory, the first executable file including:
- a first plurality of components that are not altered by the operating system when loaded into the memory;
- identifying a second executable file in the non-volatile storage, wherein the first executable file is associated with the second executable file by the operating system;
- comparing a size of a first component of a second plurality of components of the first executable file and a size of a first component of the first plurality of components of the second executable file;
- identifying permissible modifications to the first executable file based on execution of the first executable file;
- and
- generating an alert if the size of the first component of the first plurality of components of the first executable file and the size of the first component of the first plurality of components of the second executable file are different, wherein the alert is not triggered when the difference relates to the permissible modifications;
- wherein the first component of the first plurality of components of the first executable file is less than the entirety of the first executable file and the first component of the first plurality of components of the second executable file is less than the entirety of the second executable file.
11 more elements
Dependencies are inferred from the claim text.