Abstract:Malware analysis is the process of determining the purpose and functionality of a given malware sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques for malicious code. In addition, it is an important prerequisite for the development of removal tools that can thoroughly delete malware from an infected machine. Traditionally, malware analysis has been a manual process that is tedious and time-intensive. Unfortunately, the number of samples that need to be analyzed by security vendors on a daily basis is constantly increasing. This clearly reveals the need for tools that automate and simplify parts of the analysis process. In this paper, we present TTAnalyze, a tool for dynamically analyzing the behavior of Windows executables. To this end, the binary is run in an emulated operating system environment and its (security-relevant) actions are monitored. In particular, we record the Windows native system calls and Windows API functions that the program invokes. One important feature of our system is that it does not modify the program that it executes (e.g., through API call hooking or breakpoints), making it more difficult to detect by malicious code. Also, our tool runs binaries in an unmodified Windows environment, which leads to excellent emulation accuracy. These factors make TTAnalyze an ideal tool for quickly understanding the behavior of an unknown malware.

Dynamic Analysis and Debugging of Binary Code for Security Applications

Supporting secure programming in web applications through interactive static analysis.

Combining Static and Dynamic Analysis to Discover Software Vulnerabilities

Differential analysis on dynamic binary and its application in malicious code analysis

Program Execution Tracer based on Dynamic Binary Instrumentation

Dynamic Binary Instrumentation Based Defense Solution Against Virtual Function Table Hijacking Attacks at C++ Binary Programs.

OFFDTAN: A New Approach of Offline Dynamic Taint Analysis for Binaries

Static program analysis assisted dynamic taint tracking for software vulnerability discovery

Dynamic Analysis of Malicious Code

Arbiter: Bridging the Static and Dynamic Divide in Vulnerability Discovery on Binary Programs

Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM

Constructing a Hybrid Taint Analysis Framework for Diagnosing Attacks on Binary Programs

Implementation of an Effective Dynamic Concolic Execution Framework for Analyzing Binary Programs.

A Survey of Software Dynamic Analysis Methods

Research on Automatic Instrumentation for Bytecode Testing and Debugging

Debugger Framework on Dynamic Binary Translation System

Executable Based Vulnerability Detection

DBAF - Dynamic Binary Analysis Framework and Its Applications.

Directed Symbolic Execution for Binary Vulnerability Mining

Review on Dynamic Taint Analysis of Binary Programs

Dynamic Code Analysis and Its Implementation in Interpreted Languages