US 2022/0046030 A1 · SIMULATING USER INTERACTIONS FOR MALWARE ANALYSIS

Abstract

Simulating user interactions during dynamic analysis of a sample is disclosed. A sample is received for analysis. Prior to execution of the sample, a baseline screenshot of a system folder is generated by accessing frame buffer data stored on a graphics card. The sample is caused to execute, at least in part using one or more hypervisor instructions to move a pointing device to an icon associated with the sample. A current screenshot of the system folder is generated by accessing current frame buffer data stored on the graphics card.

Claims17

Dependent claims

A system, comprising:

a processor configured to:
receive a sample for analysis;
generate, prior to execution of the sample, a baseline screenshot of a system folder by accessing frame buffer data stored on a graphics card;
cause the sample to execute, at least in part by using one or more hypervisor instructions to move a pointing device to an icon associated with the sample;
and
generate a current screenshot of the system folder by accessing current frame to buffer data stored on the graphics card;
and
a memory coupled to the processor and configured to provide the processor with instructions.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application

17/508,737Filed 22 Oct 2021

Priority

13 Sep 2019

Published

10 Feb 2022

Term ends

Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
G06F 9/45558
Hypervisors; Virtual machine monitors: hypervisor-specific management and integration aspects
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
G06F 2009/45587
Hypervisor-specific management and integration aspects: isolation or security of virtual machine instances

Simulating user interactions for malware analysis

Life of this patent

Simulating user interactions for malware analysis

Life of this patent

Abstract

Claims17