Patent ID: 11874924
Assignee: PALO ALTO NETWORKS, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 1:
2. The system of claim 1, wherein the triggering of the dynamic behavior comprises to:
perform three or more of the following:
A) perform a uniform resource locator (URL) path check, comprising to:
determine that the malware sample requires being executed in a special URL path before triggering the dynamic behavior, wherein in the event that the malware sample is not being executed in the special URL path, the malware sample fails to execute; and
execute the malware sample in a customized specialized URL path that corresponds with the special URL path;

B) perform a Document Object Model (DOM) element check, comprising to:
determine that the malware sample requires one or more DOM elements to exist in a webpage before triggering the dynamic behavior, wherein the one or more DOM elements includes an input form, a submit button, or a combination thereof; and
create the one or more required DOM elements before executing the malware sample;

C) perform an input value check, comprising to:
determine that the malware sample requires a correct value of one or more DOM elements before triggering the dynamic behavior, wherein the correct value corresponds with a word that has a length of at least one character, corresponds with a number that has at least a predetermined number of digits, is equal to a predetermined number of digits in length, or any combination thereof; and
create the correct value for the one or more DOM elements before executing the malware sample;

D) perform an event trigger, comprising to:
determine that a special event is triggered before triggering the dynamic behavior; and
hook an event handler to send a submit button event to trigger the special event in the event that the malware sample adds the event handler to be triggered before executing the malware sample;

E) perform a special event trigger, comprising to:
determine that a timer event is triggered before triggering the dynamic behavior; and
reduce a time out of a timer mechanism for the malware sample to allow the malware sample to be executed sooner before executing the malware sample, wherein the malware sample executes a wait time timer before executing; or

F) perform a library dependency check, comprising to:
determine that the malware sample requires one or more javascript libraries before triggering the dynamic behavior; and
loading the one or more required javascript libraries before executing the malware sample, wherein the loading of the one or more required javascript libraries comprises omitting to load a non-required javascript library.