Fireeye, Inc.

Mandiant Corporation

Peter Silberman

Nick J Harbour

James Butler

Todd Plantenga

Damieon Stark

James R Butler, Ii

A device for classifying malware including a processor, and a storage device storing a plurality of previously classified symfunc hash values and malware detection logic which attempts to classify malicious code by utilizing binary disassembler logic processed by the processor. Binary disassembler logic can be configured to receive a suspicious binary object and disassemble the binary object into disassembled code data, while symbolic analyzer logic can be configured to receive the disassembled code data and generate symbolic representation data. Generation logic can be configured to receive the symbolic representation data and generate at least one symfunc hash value based on the symbolic representation data. Finally, classification logic can be configured to receive at least one symfunc hash value, compare the symfunc hash value against previously classified symfunc hash values, and determine if the binary object comprises malicious code based on the associated symfunc hash value. The reporting logic can issue an alert reporting the malicious code or initiate the execution of a pre-determined action.

Determining malware via symbolic function hash analysis

Detecting executable machine instructions in a data stream is accomplished by accessing a plurality of values representing data contained within a memory of a computer system and performing pre-processing on the plurality of values to produce a candidate data subset. The pre-processing may include determining whether the plurality of values meets (a) a randomness condition, (b) a length condition, and/or (c) a string ratio condition. The candidate data subset is inspected for computer instructions, characteristics of the computer instructions are determined, and a predetermined action is taken based on the characteristics of the computer instructions.

System and method for detecting executable machine instructions in a data stream

Detecting executable machine instructions in a data is accomplished by accessing a plurality of values representing data contained within a memory of a computer system and performing pre-processing on the plurality of values to produce a candidate data subset. The pre-processing may include determining whether the plurality of values meets (a) a randomness condition, (b) a length condition, and/or (c) a string ratio condition. The candidate data subset is inspected for computer instructions, characteristics of the computer instructions are determined, and a predetermined action taken based on the characteristics of the computer instructions.

Growing community of inventors

Kensington, MD, United States of America

Peter Silberman