Patent Document ID: 10061924
Application ID: 14986362
Patent Status: 1

Claim One:
1. A computer implemented method for detecting malicious code that modifies an in-memory process, based on deviations in executable image import resolutions and load patterns, the method comprising: running, by a computer, each one of a plurality of trusted executable images in a controlled environment; generating, by the computer, a baseline import-load signature of each one of the plurality of trusted executable images when run in the controlled environment, wherein a baseline import-load signature of a specific trusted executable image comprises a unique binary signature of a resolution of importing external code and loading external code libraries by the specific trusted executable image when run in the controlled environment; storing, by the computer, the generated baseline import-load signatures; running, by the computer, a sample program being tested for maliciousness in the controlled environment; identifying, by the computer, the sample program running a specific executable image in the controlled environment; generating, by the computer, an import-load signature of the specific executable image, wherein the import load signature of the specific executable image comprises a unique binary signature of a resolution of importing external code and loading external code libraries, by the specific executable image when run by the sample program; comparing, by the computer, the import-load signature of the specific executable image when run by the sample program to a corresponding stored baseline import-load signature for the same specific executable image; and adjudicating, by the computer, the sample program as being benign or malicious based on at least results of the comparison.