Patent ID: 7409718
Filing Date: 2008-08-05
Classification: G06F

Abstract:
1. A method of analyzing and decrypting a malicious encryption script, comprising the steps of: classifying a malicious script encryption method into a case where a decryption function exists in malicious scripts and is an independent function that is not dependent on external codes, a case where a decryption function exists and is a dependent function that is dependent on external codes, and a case where a decryption function does not exist; if the decryption function exists in malicious scripts and is the independent function that is not dependent on the external codes, extracting a call expression and a function definition for the independent function, executing or emulating the extracted call expression and function definition for the independent function, and obtaining a decrypted script by putting a result value based on the execution or emulation into an original script at which an original call expression is located; wherein dependency of the decryption function on the external codes is established by determining that all codes within the decryption function are defendant on external codes, that actual parameters for decryption function call in all program are constants, and that only functions with no side effects in the decryption function are called; and wherein no dependency of all codes within the decryption function on external codes is established by determining whether all codes within function F where V E where n is the number of functions defined in the script, F A D V