Patent ID: 7814544

Claim:
A computer system comprising: a memory having stored therein an application program interface (API)-profile guided unpacking application; and a processor coupled to said memory, wherein execution of said API-profile guided unpacking application generates a method comprising: receiving an executable program, said executable program including at least a portion of packed code; initiating execution of said executable program in an API-monitored environment, said API-monitored environment intercepting calls to one or more APIs issued by said execution of said executable program code prior to execution of said one or more APIs, said execution of said executable program generating a memory image; accessing a packer API profile list, said packer API profile list comprising one or more packer API profiles, each of said one or more packer API profiles further comprising a set of one or more APIs utilized by an associated known packer to unpack packed code; intercepting a call to an API issued by said execution of said executable program, said call identifying a called API; stalling execution of said called API; determining whether said called API matches an API within an API set of a packer API profile in said packer API profile list; allowing said called API to execute and allowing said executable program to continue said execution, when said determining finds said called API corresponds to an API within an API set of a packer API profile in said packer API profile list; stopping said execution of said executable program, when said determining finds said called API does not correspond to an API within an API set of a packer API profile in said packer API profile list; and evaluating, following said stopping, said memory image for a detection of malicious code.