Patent ID: 11874924
Assignee: PALO ALTO NETWORKS, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 4:
5. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
executing a malware sample in an instrumented virtual environment; and
triggering dynamic behavior based on emulated user interactions, comprising:
performing one or more of the following:
A) performing a uniform resource locator (URL) path check, comprising:
determining that the malware sample requires being executed in a special URL path before triggering the dynamic behavior, wherein in the event that the malware sample is not being executed in the special URL path, the malware sample fails to execute; and
executing the malware sample in a customized specialized URL path that corresponds with the special URL path;

B) performing a Document Object Model (DOM) element check, comprising:
determining that the malware sample requires one or more DOM elements to exist in a webpage before triggering the dynamic behavior, wherein the one or more DOM elements includes an input form, a submit button, or a combination thereof; and
creating the one or more required DOM elements before executing the malware sample;

C) performing an input value check, comprising:
determining that the malware sample requires a correct value of one or more DOM elements before triggering the dynamic behavior, wherein the correct value corresponds with a word that has a length of at least one character, corresponds with a number that has at least a predetermined number of digits, is equal to a predetermined number of digits in length, or any combination thereof; and
creating the correct value for the one or more DOM elements before executing the malware sample;

D) performing an event trigger, comprising:
determining that a special event is triggered before triggering the dynamic behavior; and
hooking an event handler to send a submit button event to trigger the special event in the event that the malware sample adds the event handler to be triggered before executing the malware sample;

E) performing a special event trigger, comprising:
determining that a timer event is triggered before triggering the dynamic behavior; and
reducing a time out of a timer mechanism for the malware sample to allow the malware sample to be executed sooner before executing the malware sample, wherein the malware sample executes a wait time timer before executing; or

F) performing a library dependency check, comprising:
determining that the malware sample requires one or more javascript libraries before triggering the dynamic behavior; and
loading the one or more required javascript libraries before executing the malware sample, wherein the loading of the one or more required javascript libraries comprises omitting to load a non-required javascript library.