Identifying Dormant Functionality in Malware Programs

Abstract

Abstract-To handle the growing flood of malware, security vendors and analysts rely on tools that automatically identify and analyze malicious code. Current systems for automated malware analysis typically follow a dynamic approach, executing an unknown program in a controlled environment (sandbox) and recording its runtime behavior. Since dynamic analysis platforms directly run malicious code, they are resilient to popular malware defense techniques such as packing and code obfuscation. Unfortunately, in many cases, only a small subset of all possible malicious behaviors is observed within the short time frame that a malware sample is executed. To mitigate this issue, previous work introduced techniques such as multipath or forced execution to increase the coverage of dynamic malware analysis. Unfortunately, using these techniques is potentially expensive, as the number of paths that require analysis can grow exponentially.In this paper, we propose REANIMATOR, a novel solution to determine the capabilities (malicious functionality) of malware programs. Our solution is based on the insight that we can leverage behavior observed while dynamically executing a specific malware sample to identify similar functionality in other programs. More precisely, when we observe malicious actions during dynamic analysis, we automatically extract and model the parts of the malware binary that are responsible for this behavior. We then leverage these models to check whether similar code is present in other samples. This allows us to statically identify dormant functionality (functionality that is not observed during dynamic analysis) in malicious programs. We evaluate our approach on thousands of realworld malware samples, and we show that our system is successful in identifying additional, malicious functionality. As a result, our approach can significantly improve the coverage of malware analysis results.

Jackdaw: Towards Automatic Reverse Engineering of Large Datasets of Binaries

“…Each sub-graph can be conveniently represented and efficiently matched using a hash. This technique is proven to be resilient against polymorphism [19] and was successfully used in recent samples by Comparetti et al in [6]. Finally, we normalize the API function names (e.g, removing 'A','W','Ex' suffixes referring to different versions of the same function).…”

“…In addition to the fingerprint information that is useful for fast indexing, we store the static information associated to each behavior as a set of offsets that identify the code into the binary. Therefore, this dictionary can be used to statically match behaviors, both in new, unseen binaries, or in binaries where such behaviors are implemented but "dormant" [6]. Notably, the ability to produce both a static and dynamic description of behaviors is useful because in this way we are not bound to dynamic analysis to identify behavior in samples.…”

“…A conservative choice would be f = 1.00, which would mean that we use as a descriptor only APIs that appear in all the sequences of dataflowdependent API calls of the cluster. This, however, is brittle and decreases the amounts of behaviors found (as will be evident in §4.2): Indeed, it does not take into account dormant behaviors [6], or the possibility that a behavior contains multiple branches and thus alternative portions of code.…”

“…A variety of staticand dynamic-analysis tools exist and are very useful to this end. Moreover, so-called "hybrid analysis" approaches can be used to balance their symmetric strengths and weaknesses [6,10,21,34]. We believe that hybrid approaches can be pushed forward and leveraged to obtain better reverse engineering tools.…”

GoldenEye: Efficiently and Effectively Unveiling Malware’s Targeted Environment

“…In [35], Kolbitsch et al proposed a multipath execution scheme for Java-script-based malware. Other research [29,46] proposed techniques to enforce execution of different malware functionalities.…”