Obfuscation-Resilient Executable Payload Extraction From Packed Malware - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2021

Obfuscation-Resilient Executable Payload Extraction From Packed Malware

Binlin Cheng
  • Fonction : Auteur
  • PersonId : 1124812
Erika A Leal
  • Fonction : Auteur
  • PersonId : 1124813
Haotian Zhang
  • Fonction : Auteur
  • PersonId : 1124814
Jianming Fu
  • Fonction : Auteur
  • PersonId : 1124815
Guojun Peng
  • Fonction : Auteur
  • PersonId : 1124816
Jean-Yves Marion

Résumé

Over the past two decades, packed malware is always a veritable challenge to security analysts. Not only is determining the end of the unpacking increasingly difficult, but also advanced packers embed a variety of anti-analysis tricks to impede reverse engineering. As malware’s APIs provide rich information about malicious behavior, one common anti-analysis strategy is API obfuscation, which removes the metadata of imported APIs from malware’s PE header and complicates API name resolution from API callsites. In this way, even when security analysts obtain the unpacked code, a disassembler still fails to recognize imported API names, and the unpacked code cannot be successfully executed. Recently, generic binary unpacking has made breakthrough progress with noticeable performance improvement. However, reconstructing unpacked code’s import tables, which is vital for further malware static/dynamic analyses, has largely been overlooked. Existing approaches are far from mature: they either can be easily evaded by various API obfuscation schemes (e.g., stolen code), or suffer from incomplete API coverage. In this paper, we aim to achieve the ultimate goal of Windows malware unpacking: recovering an executable malware program from the packed and obfuscated binary code. Based on the process memory when the original entry point (OEP) is reached, we develop a hardware-assisted tool, API-Xray, to reconstruct import tables. Import table reconstruction is challenging enough in its own right. Our core technique, API Micro Execution, explores all possible API callsites and executes them without knowing API argument values. At the same time, we take advantage of hardware tracing via Intel Branch Trace Store and NX bit to resolve API names and finally rebuild import tables. Compared with the previous work, API-Xray has a better resistance against various API obfuscation schemes and more coverage on resolved Windows API names. Since July 2019, we have tested API-Xray in practice to assist security professionals in malware analysis: we have successfully rebuilt 155, 811 executable malware programs and substantially improved the detection rate for 7, 514 unknown or new malware variants.
Fichier principal
Vignette du fichier
Marion-Usenix2021.pdf (1.42 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03549482 , version 1 (31-01-2022)

Identifiants

  • HAL Id : hal-03549482 , version 1

Citer

Binlin Cheng, Ming Jiang, Erika A Leal, Haotian Zhang, Jianming Fu, et al.. Obfuscation-Resilient Executable Payload Extraction From Packed Malware. 30th Usenix Security Sympoisum, Aug 2021, Virtual, United States. ⟨hal-03549482⟩
50 Consultations
281 Téléchargements

Partager

Gmail Facebook X LinkedIn More