Ecole d'ingénieur et centre de recherche en Sciences du numérique

RAMBO: Run-time packer analysis with multiple branch observation

Ugarte-Pedrero, Xabier; Balzarotti, Davide; Santos, Igor; Bringas, Pablo G

DIMVA 2016, 13th Conference on Detection of Intrusions and Malware & Vulnerability Assessment, July 7-8, 2016, San Sebastian, Spain / Also published in LNCS, Vol. 9721/2016

Run-time packing is a technique employed by malware authors in order to conceal (e.g., encrypt) malicious code and recover it at run-time. In particular, some run-time packers only decrypt individual regions of code on demand, re-encrypting them again when they are not running. This technique is known as shifting decode frames and it can greatly complicate malware analysis. The first solution that comes to mind to analyze these samples is to apply multi-path exploration to trigger the unpacking of all the code regions. Unfortunately, multi-path exploration is known to have several limitations, such as its limited scalability for the analysis of real-world binaries. In this paper, we propose a set of domain-specific optimizations and heuristics to guide multi-path exploration and improve its efficiency and reliability for unpacking binaries protected with shifting decode frames.

Document Doi Bibtex

Titre:RAMBO: Run-time packer analysis with multiple branch observation
Mots Clés:Malware, Unpacking, Multi-path exploration
Type:Conférence
Langue:English
Ville:San Sebastian
Pays:ESPAGNE
Date:
Département:Sécurité numérique
Eurecom ref:4894
Copyright: © Springer. Personal use of this material is permitted. The definitive version of this paper was published in DIMVA 2016, 13th Conference on Detection of Intrusions and Malware & Vulnerability Assessment, July 7-8, 2016, San Sebastian, Spain / Also published in LNCS, Vol. 9721/2016 and is available at : http://dx.doi.org/10.1007/978-3-319-40667-1_10
Bibtex: @inproceedings{EURECOM+4894, doi = {http://dx.doi.org/10.1007/978-3-319-40667-1_10}, year = {2016}, title = {{RAMBO}: {R}un-time packer analysis with multiple branch observation}, author = {{U}garte-{P}edrero, {X}abier and {B}alzarotti, {D}avide and {S}antos, {I}gor and {B}ringas, {P}ablo {G}}, booktitle = {{DIMVA} 2016, 13th {C}onference on {D}etection of {I}ntrusions and {M}alware \& {V}ulnerability {A}ssessment, {J}uly 7-8, 2016, {S}an {S}ebastian, {S}pain / {A}lso published in {LNCS}, {V}ol. 9721/2016}, address = {{S}an {S}ebastian, {ESPAGNE}}, month = {07}, url = {http://www.eurecom.fr/publication/4894} }
Voir aussi: