Dependency emulation for executable samples
OwnerEsmid Idrizovic, Robert Jung +2inventors
InventorsEsmid Idrizovic, Robert Jung, Daniel Raygoza, Michael S. Hughes
Life of this patent
Estimating the term…
Abstract
Techniques for dependency emulation for executable samples are disclosed. In some embodiments, a system/process/computer program product for dependency emulation for executable samples includes receiving a sample for emulation for malware detection; determining that one or more libraries are missing from the sample for execution of the sample in an emulation environment; generating one or more stub libraries to facilitate the execution of the sample in the emulation environment; and executing the sample in the emulation environment.
Claims20
A system, comprising:
- a processor configured to:
- receive a sample for emulation for malware detection;
- determine that one or more libraries are missing from the sample for execution of the sample in an emulation environment;
- generate one or more stub libraries to facilitate the execution of the sample in the emulation environment;
- and
- execute the sample in the emulation environment;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving a sample for emulation for malware detection;
- determining that one or more libraries are missing from the sample for execution of the is sample in an emulation environment;
- generating one or more stub libraries to facilitate the execution of the sample in the emulation environment;
- and
- executing the sample in the emulation environment.
A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:
- receiving a sample for emulation for malware detection;
- determining that one or more libraries are missing from the sample for execution of the sample in an emulation environment;
- generating one or more stub libraries to facilitate the execution of the sample in the emulation environment;
- and
- executing the sample in the emulation environment.
A system, comprising:
- a processor configured to:
- receive a sample for emulation for malware detection;
- determine that one or more libraries are missing from the sample for execution of the sample in an emulation environment;
- intercept a loader response for a dynamic linked library (DLL) search and generate a spoofed import response to facilitate the execution of the sample in the emulation environment;
- and
- execute the sample in the emulation environment;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
Dependencies are inferred from the claim text.