Abstract: Techniques for early exit dynamic analysis of a virtual machine are disclosed. In some embodiments, a system/process/computer program product for early exit dynamic analysis of a virtual machine includes initiating a dynamic analysis of a malware sample by executing the malware sample in a virtual computing environment; monitoring activities of the malware sample during execution of the malware sample in the virtual computing environment; and determining when to exit the dynamic analysis before a predetermined period of time.

Abstract: The present application discloses a method, system, and computer system for detecting malicious files. The method includes executing a sample in a virtual environment, and determining whether the sample is malware based at least in part on memory-use artifacts obtained in connection with execution of the sample in the virtual environment.

Abstract: Techniques for providing enhanced live virtual machine file system instrumentation for security analysis are disclosed. In some embodiments, a system/process/computer program product for providing enhanced live virtual machine file system instrumentation for security analysis includes receiving a sample for automated dynamic analysis using a computing environment; freezing time in the computing environment in response to detecting an event during execution of the sample in the computing environment and reassemble one or more files; and performing an automated malware analysis using results of the automated dynamic analysis and the one or more reassembled files.

Abstract: The present application discloses a method, system, and computer system for detecting malicious files. The method includes executing a sample in a virtual environment, and determining whether the sample is malware based at least in part on memory-use artifacts obtained in connection with execution of the sample in the virtual environment.

Abstract: The detection of phishing Portable Document Format (PDF) files using an image-based deep learning approach is disclosed. A PDF document is received. A likelihood that the received PDF document represents a threat is determined, at least in part, by using an image based model that was previously trained, at least in part, using a plurality of images that were generated using one or more tools that collectively convert a set of given PDF document files to the respective plurality of images. A verdict for the PDF document is provided as output based at least in part on the determined likelihood.

Abstract: The detection of phishing Portable Document Format (PDF) files using an image-based deep learning approach is disclosed. A PDF document that includes a Universal Resource Locator is received. A likelihood that the received PDF document represents a phishing threat is determined, at least in part, by using an image based model. A verdict for the PDF document is provided as output based at least in part on the determined likelihood.

Abstract: Techniques for identifying malware based on system API function pointers are disclosed. In some embodiments, a system/process/computer program product for identifying malware based on system API function pointers includes monitoring changes in memory during execution of a malware sample in a computing environment; detecting a dynamic evasion behavior using an Application Programming Interface (API) vector comprising a plurality of system API function pointers identified in the memory during execution of the malware sample in the computing environment; and generating a signature based on the API vector for automatically detecting the malware during execution in the memory, wherein the malware sample was determined to be malicious.

Abstract: Techniques for identifying malware based on system API function pointers are disclosed. In some embodiments, a system/process/computer program product for identifying malware based on system API function pointers includes monitoring changes in memory during execution of a malware sample in a computing environment; detecting a dynamic evasion behavior using an Application Programming Interface (API) vector comprising a plurality of system API function pointers identified in the memory during execution of the malware sample in the computing environment; and generating a signature based on the API vector for automatically detecting the malware during execution in the memory, wherein the malware sample was determined to be malicious.

Abstract: Techniques for early exit dynamic analysis of a virtual machine are disclosed. In some embodiments, a system/process/computer program product for early exit dynamic analysis of a virtual machine includes initiating a dynamic analysis of a malware sample by executing the malware sample in a virtual computing environment; monitoring activities of the malware sample during execution of the malware sample in the virtual computing environment; and determining when to exit the dynamic analysis before a predetermined period of time.

Abstract: A hypervisor-based service monitors antimalware scan interface (AMSI) events triggered from inside a virtual machine (VM) to analyze behavior of software samples. A sample is loaded into a VM for execution by an AMSI-enabled application/service of the VM. The monitoring service can register a dummy AMSI provider for the VM, which enables the AMSI for compatible applications/services of the VM upon registration but does not implement buffer scanning or analysis. The monitoring service hooks into at least a first function of the AMSI by which buffers are submitted for a malware scan. Upon invocation of the function from inside the VM, the monitoring service intercepts the buffer submission and analyzes the buffer based on criteria for detecting an AMSI bypass attempt. If at least a first AMSI bypass detection criterion is satisfied, the monitoring service blocks the attempted AMSI bypass and continues monitoring execution of the sample.

Abstract: The present application discloses a method, system, and computer system for detecting malicious files. The method includes (a) receiving a sample for malware analysis, (b) applying a machine learning model to obtain a classification for the sample based at least in part on (i) memory artifact data associated with the sample, and (ii) at least one of dynamic execution log data for the sample and static file structures associated with the sample, and (c) determining whether the sample is malicious based at least in part on the classification.

Abstract: Techniques for early exit dynamic analysis of a virtual machine are disclosed. In some embodiments, a system/process/computer program product for early exit dynamic analysis of a virtual machine includes initiating a dynamic analysis of a malware sample by executing the malware sample in a virtual computing environment; monitoring activities of the malware sample during execution of the malware sample in the virtual computing environment; and determining when to exit the dynamic analysis before a predetermined period of time.

Abstract: Techniques for dependency emulation for executable samples are disclosed. In some embodiments, a system/process/computer program product for dependency emulation for executable samples includes receiving a sample for emulation for malware detection; determining that one or more libraries are missing from the sample for execution of the sample in an emulation environment; generating one or more stub libraries to facilitate the execution of the sample in the emulation environment; and executing the sample in the emulation environment.

Abstract: The detection of phishing Portable Document Format (PDF) files using an image-based deep learning approach is disclosed. A PDF document that includes a Universal Resource Locator is received. A likelihood that the received PDF document represents a phishing threat is determined, at least in part, by using an image based model. A verdict for the PDF document is provided as output based at least in part on the determined likelihood.

Abstract: The present application discloses a method, system, and computer system for detecting malicious files. The method includes executing a sample in a virtual environment, and determining whether the sample is malware based at least in part on memory-use artifacts obtained in connection with execution of the sample in the virtual environment.

Abstract: Techniques for early exit dynamic analysis of a virtual machine are disclosed. In some embodiments, a system/process/computer program product for early exit dynamic analysis of a virtual machine includes initiating a dynamic analysis of a malware sample by executing the malware sample in a virtual computing environment; monitoring activities of the malware sample during execution of the malware sample in the virtual computing environment; and determining when to exit the dynamic analysis before a predetermined period of time.