Mcafee, Inc.

Chong Xu

Bing Sun

Zheng Bu

Jeff Hetzler

Yichong Lin

Praveen Kumar Amritaluru

Mayank Bhatnagar

Haifei Li

Xiaobo Chen

Hirosh Joseph

Qiang Liu

Navtej Singh

Mechanisms for analyzing a structured file for malicious content are provided, comprising: parsing the structured file into a plurality of portions; selecting a selected portion of the portions; checking the selected portion to determine if at least one pre-condition is met; and in response to determining that the at least one pre-condition is met: decoding the selected portion to form a decoded portion; and checking the decoded portion to determine if it is malicious. In some embodiments: the at least one pre-condition can be changed; the structured file is a MICROSOFT OFFICE XML file; the selected portion is a file; the at least one pre-condition checks at least one attribute of the selected portion; decoding the selected portion comprises decompressing the selected portion; and/or checking the decoded portion to determine if it is malicious comprises checking whether a previously decoded portion of the structure file meets at least one condition.

Systems, methods, and media for analyzing structured files for malicious content

Systems and methods for detection of malicious exploitations in a multimedia file are disclosed. In one embodiment, such an approach includes parsing the compiled bytecode of a multimedia file to detect identified key instructions and determine if such key instructions are repeated in specific patterns that signify the presence of malicious exploitation. The approach may also include examining the contents of the constant pool table in a compiled multimedia file to detect specific shellcode strings that are indicative of presence of malicious exploitation. When the bytecode or the constant pool table indicates that malicious exploitation is present, an approach may be utilized to reduce instances of false positive identification of malicious exploitation.

System and method of detecting malicious multimedia files

A method is provided in one example embodiment and includes initiating an execution of a compiled script, evaluating a function called in the compiled script, detecting an execution event based on at least a first criterion, and storing information associated with the execution event in an execution event queue. The method also includes verifying a correlation signature based on information associated with at least one execution event in the execution event queue. In specific embodiments, the method includes evaluating an assignment statement of a script during compilation of the script by a compiler, detecting a compilation event based on at least a second criterion, and storing information associated with the compilation event in a compilation event queue. In yet additional embodiments, the verification of the correlation signature is based in part on information associated with one or more compilation events in the compilation event queue.

Detection of malicious scripting language code in a network environment

An apparatus, method, computer readable storage medium are provided in one or more examples and comprise accessing an application, identifying an access token of the application, determining if the access token is a system token, and responsive to the access token failing to be a system token, enabling a runtime module.

Generic privilege escalation prevention

By injecting bytecode into a predetermined method of a sandbox environment, an application that uses an exploit to attempt to escape from the sandbox environment may be detected without knowledge of the application or the exploit used to attempt to escape from the sandbox environment. Upon indicating that the application has escaped the sandbox, the application may be terminated or the escape may be reported, allowing further monitoring of the application.

Growing community of inventors

Sunnyvale, CA, United States of America

Chong Xu