Systems and methods for identifying external functions called by untrusted applications

A system for identifying external functions called by an untrusted application, the system comprising:

• an emulation module programmed to:
• load an untrusted application into an emulated computing environment, wherein the untrusted application comprises at least one computer-executable instruction that calls an external function and the untrusted application obfuscates the name of the external function to be called by the computer-executable instruction by replacing the name of the external function with a checksum;
• execute the computer-readable instruction within the emulated computing environment;
• a memory-access module programmed to intercept a request to access a specific memory location within an external-function-specific region of memory;
• a function-identification module programmed to identify, by analyzing the request, the name of the external function to be called by the computer-readable instruction by:
• identifying the memory location specified in the request;
• identifying an entry in an export address table that corresponds to the memory location specified in the request;
• an import-table-creation module programmed to:
• store the name of the external function to be called by the computer-readable instruction within a private memory location that cannot be accessed by the untrusted application;
• recreate an import table for the untrusted application based at least in part on the name of the external function stored within the private memory location;
• at least one processor configured to execute the emulation module, the memory-access module, and the function-identification module.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by a computing device, cause the computing device to:

• load an untrusted application into an emulated computing environment, wherein the untrusted application comprises at least one computer-executable instruction that calls an external function and the untrusted application obfuscates the name of the external function to be called by the computer-executable instruction by replacing the name of the external function with a checksum;
• execute the computer-readable instruction within the emulated computing environment;
• intercept a request to access a specific memory location within an external-function-specific region of memory;
• identify, by analyzing the request, the name of the external function to be called by the computer-readable instruction by:
• identifying the memory location specified in the request;
• identifying an entry in an export address table that corresponds to the memory location specified in the request;
• store the name of the external function to be called by the computer-readable instruction within a private memory location that cannot be accessed by the untrusted application;
• recreate an import table for the untrusted application based at least in part on the name of the external function stored within the private memory location.