紀要論文

動的解析と静的解析を連携したマルウェアのサンドボックス回避条件抽出

EXTRACTION OF SANDBOX EVASION CONDITIONS FOR MALWARE BY COMBINING DYNAMIC AND STATIC ANALYSIS

jpn

24368083

https://doi.org/10.15002/00030757

法政大学大学院理工学研究科

法政大学大学院紀要. 理工学研究科編

65

1

8

2024-03-24

Version of Record

In this study, we address the daily analysis of malware, particularly focusing on types that include functions to evade detection. Notably, we examine malware that can detect an analysis environment, such as a sandbox, and conceal its presence. We propose a simple and rapid method to extract the conditions under which such malware detects sandboxes and avoids analysis. This method mechanistically extracts evasion conditions by integrating dynamic binary instrumentation (dynamic analysis) and symbolic execution (static analysis). As a preliminary step to experiments using actual malware, we prepared pseudo-malware equipped with various evasion functions and evaluated them by extracting evasion conditions using the method proposed in this study. As a result, we succeeded in identifying evasion conditions for 5 out of 13 samples and obtained clues to evasion conditions for the other 6 samples. On the other hand, it became clear that there is room for improvement in the programs used for dynamic binary instrumentation and symbolic execution.

Article