Patent ID: 8407787
Filing Date: 2013-03-26
Classification: G06F

Abstract:
1. A computer apparatus configured with malicious code detection, the apparatus comprising: data storage configured to store computer-readable instructions and data; a processor configured to execute computer-readable instructions and to access said data storage; computer-readable code configured to initialize an emulator; computer-readable code configured to create a process environment block which is modified to control a process environment of a program being executed by the emulator; computer-readable code configured to create a thread information block which is modified to control a thread being executed by the emulator; computer-readable code configured to process import dynamic link libraries; computer-readable code configured to emulate instructions of a target program using the emulator; computer-readable code configured to intercept select application programming interface calls using an intercept list during the program emulation; computer-readable code configured such that, if a calling application programming interface address matches a record in the intercept list, then the application programming interface name and number of parameters are retrieved from the match record; computer-readable code configured to fetch said parameters from a stack base; and computer-readable code configured to determine whether to overwrite the application programming interface, and if the application programming interface is to be overwritten, then executing a previously defined function.