Abstract:Malware analysis is the process of determining the purpose and functionality of a given malware sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques for malicious code. In addition, it is an important prerequisite for the development of removal tools that can thoroughly delete malware from an infected machine. Traditionally, malware analysis has been a manual process that is tedious and time-intensive. Unfortunately, the number of samples that need to be analyzed by security vendors on a daily basis is constantly increasing. This clearly reveals the need for tools that automate and simplify parts of the analysis process. In this paper, we present TTAnalyze, a tool for dynamically analyzing the behavior of Windows executables. To this end, the binary is run in an emulated operating system environment and its (security-relevant) actions are monitored. In particular, we record the Windows native system calls and Windows API functions that the program invokes. One important feature of our system is that it does not modify the program that it executes (e.g., through API call hooking or breakpoints), making it more difficult to detect by malicious code. Also, our tool runs binaries in an unmodified Windows environment, which leads to excellent emulation accuracy. These factors make TTAnalyze an ideal tool for quickly understanding the behavior of an unknown malware.

A method for hidden malcode anomaly detection using dynamic control-flow analysis

Implicit-Flow-Sensitive Method for Detection of Trojan-Spy Programs

Malware Detection Based on Critical Application Programming Interface Graph

A Malicious Behavior Analysis Method Based on Program Semantic

A Static Method for Detection of Information Theft Malware

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

A New Approach to Malware Detection

Efficient And Practical Control Flow Monitoring For Program Security

A Method and Implementation of Control Flow Obfuscation Using SEH

Control-flow Monitoring Method Based on Function Signature

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis

Program Intrusion Detection Based on Simplified Control Flow Monitoring

Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM

Dynamic Analysis of Malicious Code

APPROACH FOR DETECTING ANTI-ANALYSIS MALWARE

A malware detection framework based on kolmogorov complexity

Method of Malware Behavior Analysis in Disassembly Level

A Function Call Graph Extraction Method Combining Static and Dynamic Analysis

A DETECTION FRAMEWORK OF CODE-HIDING EVASION TECHNIQUE BASED ON ANDROID SYSTEM

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

Novel Method of Control Flow and Structural Coverage Measurement for Object Code Verification