Using Memory Management to Detect and Extract Illegitimate Code for Malware Analysis

  • Exploits that successfully attack computers are mostly based on some form of shellcode, i.e., illegitimate code that is injected by the attacker to take control of the system. Detecting and extracting such code is the first step to detailed analysis of malware containing illegitimate code. The amount and sophistication of modern malware calls for automated mechanisms that perform such detection and extraction. In this paper we present a novel generic and fully automatic approach to detect the execution of illegitimate code and extract such code upon detection. The basic idea is to flag critical memory pages as non-executable and use a modified page fault handler to dump corresponding memory Exploits that successfully attack computers are mostly based on some form of shellcode, i.e., illegitimate code that is injected by the attacker to take control of the system. Detecting and extracting such code is the first step to detailed analysis of malware containing illegitimate code. The amount and sophistication of modern malware calls for automated mechanisms that perform such detection and extraction. In this paper we present a novel generic and fully automatic approach to detect the execution of illegitimate code and extract such code upon detection. The basic idea is to flag critical memory pages as non-executable and use a modified page fault handler to dump corresponding memory pages. We present an implementation of the approach for the Windows platform called CWXDetector. Evaluations using a large corpus of malicious PDF documents show that our system produces no false positives and has a similarly low false negative rate.show moreshow less

Download full text files

Export metadata

  • Export Bibtex
  • Export RIS

Additional Services

Share in Twitter Search Google Scholar
Metadaten
Author:Carsten Willems, Felix C. Freiling
URN:urn:nbn:de:bvb:29-opus-30925
Series (Volume number):Technical reports / Department Informatik (CS-2012-01)
Document Type:Report
Language:German
Date of Publication (online):2012/02/17
Publishing Institution:Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU)
Release Date:2012/02/17
Tag:Pagefault Handler; Reverse Engineering
SWD-Keyword:Computerforensik; Malware; Speicherverwaltung
Institutes:Technische Fakultät / Technische Fakultät -ohne weitere Spezifikation-
Dewey Decimal Classification:0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 004 Datenverarbeitung; Informatik

$Rev: 13581 $