Patent ID: 9471783
Filing Date: 2016-10-18
CPC Classification: G06F

Claim Text:
1. A non-transitory computer-readable medium comprising instructions stored thereon that when executed cause one or more processing units to: load a self-extracting executable into memory, the self-extracting executable comprising a first unpacking stub and a packed executable; allow the first unpacking stub to unpack the packed executable into an unpacked executable; detect an attempt to write to a memory page in which code was previously executed, by controlling memory page access permissions using hardware assisted virtualization; detect an attempt to execute code that was previously written into a memory page by the first unpacking stub, by controlling the memory page access permissions using the hardware assisted virtualization; detect completion of unpacking the packed executable by the first unpacking stub using one or more heuristics; and scan the unpacked executable for malware, wherein the one or more heuristics comprise: