PolyUnpack: Automating the hidden-code extraction of unpack-executing malware

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2006, Pages 289-298

  Royal, Paul ^a   Halpin, Mitch ^a   Dagon, David ^a   Edmonds, Robert ^a   Lee, Wenke ^a  

^a Georgia Institute of Technology

Author keywords

[No Author keywords available]

Indexed keywords

COMPLLE-TIME; HIDDEN-CODE BODIES; MALWARE INSTANCE; STATIC CODE MODEL;

BINARY CODES; COMPUTER SOFTWARE; INTRUSION DETECTION; MATHEMATICAL MODELS;

FEATURE EXTRACTION;

EID: 34748820878     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ACSAC.2006.38     Document Type: Conference Paper

References (18)

1. E. Carrera and G. Erdélyi. Digital genome mapping: Advanced binary malware analysis. Virus Bulletin, 2004.
2. M. Christodorescu and S. Jha. Testing malware detectors. In Proceedings of the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA '04), 2004.
3. M. Christodorescu, S. Jha, S. A. Seshia, D. Song, and R. E. Bryant. Semantics-aware malware detection. In IEEE Symposium on Security and Privacy, May 2005.
4. DataRescue, Inc. The ida pro disassembler. www.datarescue.com/idabase, 2006.
5. Gigapede. OllyDump v. 3.0, 2006.
6. I. Guilfanov. Personal correspondence. January 30 2006.
7. C. Hoepers. Phishing's Cutting Edge: Brazil and the Future of Phishing. www.antiphishing.org/events/apwg_nov_05_montreal.html, 2005.
8. Internet System Consortium. Isc oarc. oarc.isc.org, 2006.
9. Jibz, Qwerton, snaker, and xineohP. PEiD. peid.has.it, 2005.
10. T. Kojm. Clam antivirus, www.clamav.net, 2006.
11. C. Kruegel, W. Robertson, F. Valeur, and G. Vigna. Static disassembly of obfuscated binaries. In Proceedings of USENIX Security 2004, pages 255-270, 2004.
12. McAfee, Inc. Advanced virus detection scan engine and dat. www.mcafee.com/us/local.content/white.papers/wp_scan_engine.pdf, 2002.
13. McAfee, Inc. Antivirus, www.mcafee.com, 2006.
14. J. Robin and C. Irvine. Analysis of the intel pentium's ability to support a secure virtual machine monitor. In Proceedings of the 9th USENIX Security Symposium, 2000.
15. R. Russell. Personal correspondence. January 29 2006.
16. P. Szor. Bad idea. Virus Bulletin, pages 18-19, April 1998.
17. P. Vandevenne. Using the universal PE plug-in in IDA Pro 4.9 to unpack compressed executables, www.datarescue.com/idabase/unpack.pe/unpacking.pdf, 2005.
18. O. Yuschuk. 80×86 32-bit disassembler and assembler. www.ollydbg.de/srcdescr.htm, 2006.