Patent ID: 8555392
Filing Date: 2013-10-08
Classification: G06F,H04L

Abstract:
1. A computer-implemented method for detecting unknown packers and cryptors, the method comprising: emulating, by a computer processor, a software object modified by an unknown packer or cryptor; collecting information about memory operations performed during the emulation; combining information about related memory operations into one or more sets of related memory operations, wherein each set includes memory operations being related at least in their address spaces; comparing, by the computer processor, the one or more sets of related memory operations with high-level memory operations commonly associated with unpacking or decryption to identify at least one set of related memory operations that performs said high-level operations on the emulated object; generating, by the computer processor, based on at least one of the identified sets of related memory operations that perform unpacking or decryption of the emulated object, a new antivirus record that describes specific behavior of the unknown packer or cryptor that performs the unpacking or decryption of the emulated object, wherein the generated new antivirus record includes an ordered sequence of one or more expressions showing an order of the identified high-level operations with each expression identifying at least a high-level operation performed on the emulated object, and generic address space parameters of each high-level operation; and using the generated new antivirus record, by the computer processor, to detect another software object modified by said unknown packer or cryptor, including: