Ao Kaspersky Lab

Kaspersky Lab, Zao

Dmitry A Kirsanov

Vladislav V Pintiysky

Denis V Anikin

Maxim Y Golovkin

Dmitry V Vinogradov

Vitaly V Butuzov

Dmitry V Karasovsky

Denis Y Kobychev

Vasily A Davydov

Vyacheslav V Zakorzhevsky

Roman Y Gavrilchenko

Mikhail A Pavlyushchik

Alexey V Monastyrsky

Vladimir A Kuskov

Sergey V Trofimenko

A method for emulating execution of a file includes emulating execution of the instructions of a file on a virtual processor of an emulator. The execution of the instructions is halted in response to an invocation of an API function. A determination is made whether the invoked API function is present in the updatable modules of the emulator. The updatable modules contain implementation of API functions. In response to determining that the invoked API function is present in the updatable modules, execution of the invoked API function is emulated according to corresponding implementation contained in the updatable modules. Otherwise, result of execution of the invoked API function is generated by executing a corresponding virtual API function on a processor of a computing device.

Emulator and emulation method

Disclosed herein are systems and methods for forming a log during an execution of a file with vulnerabilities. In one aspect, an exemplary method comprises, discovering an activation of a trigger during an execution of a thread of a process created upon opening the file, wherein the trigger describes conditions accompanying an event which relates to an attempt to exploit a vulnerability of the file, analyzing a stack of the process created upon opening the file, and discovering a chain of function calls preceding the event in a form of a sequence of call and return addresses, analyzing the discovered chain of function calls for fulfillment of conditions of the trigger which relate to the attempt to exploit the vulnerability, and when the conditions of the trigger are fulfilled, saving information about the chain of function calls in a log.

System and method of forming a log when executing a file with vulnerabilities in a virtual machine

Disclosed herein are systems and methods of categorizing a .NET application. In one aspect, an exemplary method comprises, by a hardware processor of a security module, launching a CLR profiler upon launching of the .NET application, forming an execution log of the .NET application and adding information about events occurring during the execution of the .NET application via the launched CLR profiler, assigning to the .NET application, a category of a predetermined list of categories based on an analysis of the execution log of the .NET application, and determining whether the .NET application is categorized as being a malicious application.

System and method for categorization of .NET applications

Disclosed is a method for analyzing a log for conducting an antivirus scan of a file. The method includes opening a file in a virtual machine. The opening of the file includes execution of a guest process having a thread in a virtual processor of the virtual machine. A plurality of events in the thread of the guest process is intercepted. Registers associated with a system call made during execution of the first thread of the guest process are determined. Execution of the thread of the guest process is halted. In a log associated with the opening of the file, information is saved indicating events intercepted during execution of the thread in an altered guest physical memory page, and context data of the virtual processor. Using at least one template having rules, the saved log is analyzed to determine whether the file opened in the virtual machine is harmful.

System and method for analyzing a log in a virtual machine based on a template

Disclosed are systems and methods for analysis of files for maliciousness and determining an action. An exemplary method comprises: opening a file, by a processor, in a virtual machine, intercepting an event arising in an execution of a thread of a process created upon opening of the file, determining, a context of the processor on which the thread is being executed, the determination including reading register values of the processor and a stack, comparing the context with rules that check: a behavior of the thread of the process, a changing, by the thread, of attributes of the file, and an access of the thread to the Internet, and based on a result of the comparison, performing at least one of: recognizing the file as being malicious, halting the execution of the thread, changing the context of the processor, and waiting for a next intercepted event.

System and method of analysis of files for maliciousness and determining an action

Disclosed are systems and methods for execution of program code by an interpreter. One exemplary method comprises: generating intermediate instructions based on a unified grammar from instructions of the program code, beginning execution of the intermediate instructions in an emulated computer environment, in response to detecting an instruction of the program code associated with an object for which a rule of interpretation is not found, halting further execution of the intermediate instructions, obtaining an auxiliary code corresponding to the object, wherein a result of execution of the auxiliary code corresponds to the result of the execution of the object, and wherein the auxiliary code contains objects for which the interpreter has a rule of interpretation, executing the instructions of the auxiliary code; and after completion of the execution of the auxiliary code, resuming the execution of the intermediate instructions.

System and method for execution of objects lacking rules of interpretation

Disclosed are systems and methods for generating a log for conducting an antivirus scan of a file. The described technique includes opening a file in a virtual machine, which causes execution of a guest process and a thread in a (virtual) processor of the virtual machine. The technique includes identifying, during execution of the first thread, events that involve alteration of guest physical memory pages of the virtual machine. The technique determines altered guest physical memory page based on analysis of the log and identifies when a transfer of control to altered guest physical memory pages has occurred. The resultant log for analysis by a security application includes information indicating the events occurring during execution of the thread in the altered guest physical memory page, and context data of the virtual processor on which the thread is being executed.

System and method of forming a log in a virtual machine for conducting an antivirus scan of a file

Disclosed are system and method for controlling execution of a computer program. An example method includes determining whether code instructions or data of interest are found in a portion of a page in an original virtual address space, when the code instructions or data are found in the portion of the page of a first type, tagging it as non-executable and tagging the portion of no interest as executable, when the code instructions or data are found in the portion of the second type, tagging it using an opcode and tagging the portion of no interest as executable, when the code instructions or data are found in the portion of the first type, duplicating the original virtual address space and tagging the portion of interest as executable and tagging the portion of no interest as non-executable and transferring execution of the computer program to a memory location other than the one in which a notification was received.

System and method for transferring control of instruction execution between address spaces

Disclosed are systems and methods of analysis of files for maliciousness in a virtual machine. An exemplary method comprises: opening and executing a file by a processor in a virtual machine; intercepting an event arising in the process of execution of a thread of a process created upon opening of the file; halting the execution of the thread; reading the context of the processor on which the thread is being executed; comparing the context of the processor with one or more rules; and based on the results of the comparison, performing at least one of: recognizing the file as being malicious; halting the execution of the process created upon opening of the file; changing the context of the processor; and waiting for the next intercepted event.

System and method of analysis of files for maliciousness in a virtual machine

Disclose are systems and methods for execution of program code by an interpreter. One exemplary method comprises: executing, by the interpreter, instructions of the program code in an emulated computer environment; when detecting, by the interpreter, an instruction of the program code associated with an unknown object for which the interpreter lacks a rule of interpretation, halting by the interpreter further execution of the instructions of the program code; obtaining, by the interpreter, an auxiliary code whose result of execution corresponds to the result of the execution of the unknown object, wherein the auxiliary code contains known objects for which the interpreter has a rule of interpretation; executing, by the interpreter, the instructions of the auxiliary code; and after completion of the execution of the auxiliary code, by the interpreter, resuming the execution of the instructions of the program code.

System and method of execution of code by an interpreter

Disclosed are system and method for controlling execution of a computer program. An example method includes determining, by a processor, a memory sector for storing a portion of execution instructions of the computer program in virtual memory address space, determining, in the virtual memory address space, one or more pages that comprise code instructions and data associated with the memory sector, creating a duplicate of the virtual memory address space, tagging the memory sector and the one or more pages in both the virtual memory address space and the duplicate of the virtual memory address space, receiving a notification to transfer execution of the computer program between different memory sectors while executing instructions stored in either the virtual memory address space or the duplicate of the virtual memory address space and transferring execution of the computer program to a memory location other than the one in which the notification was received.

System and method for transferring execution of a computer program

Disclosed are system and method for controlling execution of a program. An example method includes determining a memory sector for storing at least a portion of execution instructions of the computer program in virtual memory address space; determining, in the virtual memory address space, one or more pages that contain code instructions and data associated with the memory sector; creating a duplicate of the virtual memory address space comprising the memory sector and the one or more pages; tagging the memory sector and the one or more pages in both the virtual memory address space and its duplicate; receiving a notification to transfer execution of the computer program between different memory sectors while executing instructions stored in either the virtual memory address space or its duplicate; and transferring execution of the computer program to a memory location other than the one in which the notification was received.

System and method of transfer of control between memory locations

Systems and methods to detect malicious executable files having a script language interpreter by combining a script emulator and a machine code emulator. A system includes an analyzer configured to convert a script into pseudocode and monitor an emulation process of the pseudocode, a script emulator configured to sequentially emulate the pseudocode and write emulation results to an emulator operation log, and a machine code emulator configured to emulate the pseudocode if a transition from pseudocode to machine code is detected by the analyzer, such that the analyzer can analyze the emulator operation log to determine if the executable file is malicious.

Systems and methods for switching emulation of an executable file

Systems and methods for detecting malicious executable files containing an interpreter by combining emulators

Disclosed are system and method for controlling execution of a program. An example method includes determining a memory sector of interest in a first virtual memory location; duplicating the memory sector of interest in a second virtual memory location; tagging the memory sector of interest in the first virtual address space and the duplicated memory sector in the second virtual address space with different tags; selecting between the memory sector of interest and the duplicated memory sector a memory location for execution of the program; executing, by a hardware processor, the program in the selected memory location until receipt of a notification to transfer execution of the program from a memory sector tagged with one tag to a memory sector tagged with a different tag; and transferring program execution to the memory location other than the one in which the notification was received.

Growing community of inventors

Moscow, Russia

Dmitry A Kirsanov