Palo Alto Networks, Inc.

Tao Yan

Bo Qu

Jiangxia Liu

Jin Chen

Taojie Wang

ChienHua Lu

Zhibin Zhang

Zhanglin He

Royce Lu

Edouard Bochin

Michael Harbison

Mengying Hu

Yue Guan

Chienhua Lu

Various techniques for malicious pattern extraction via fuzzing are disclosed. In some embodiments, a system/process/computer program product for malicious pattern extraction via fuzzing includes receiving a malicious sample (e.g., the malicious sample can be an executable file, such as a binary, script, etc., or a file that includes content for inputting into an application, such as for an office productivity suite or another application); mutating the malicious sample using fuzzing; and generating a signature based on a critical path (e.g., a malware signature can be automatically generated by a cloud security service for detection of the malicious sample, and the cloud security service can distribute the malware signature to a plurality of firewalls and/or other security entities to subscribers of a security service).

Malicious pattern extraction via fuzzing

Detection of an exploit including shellcode is disclosed. Memory blocks are monitored during dynamic analysis of a sample to identify a memory block including suspicious shellcode. The memory block is dumped in memory to identify a candidate shellcode entry point associated with the suspicious shellcode. The suspicious shellcode is executed based on the candidate shellcode entry point to determine whether the suspicious shellcode is malicious. A verdict is generated regarding the sample based on results of executing the suspicious shellcode.

System and method for detecting exploit including shellcode

Various techniques for detecting obfuscated web skimmers based on encoding and hooking are disclosed. In some embodiments, a system/process/computer program product for detecting obfuscated web skimmers based on encoding and hooking includes receiving a sample; performing static analysis on the sample using encoded web skimmer detection rules (e.g., encoded using a plurality of encoding methods); performing dynamic analysis on the sample using hooking; and detecting an obfuscated web skimmer based on results of the static analysis using the encoded web skimmer detection rules and/or the dynamic analysis using hooking.

Detecting obfuscated web skimmers based on encoding and hooking

The present application discloses a method, system, and computer system for detecting Return Oriented Programming (ROP) exploits. The method includes (i) intercepting, by one or more processors, a memory attribute change function for a sample; (ii) determining if a return address is associated with a shellcode address, and (iii) in response to determining that the return address is associated with the shellcode address, determining that the sample is an ROP exploit.

Return address validation watchdog to discover ROP chains in exploits engineering cloud delivered security services (CDSS)

Detection of malicious JavaScript based on automated user interaction emulation is disclosed. A malware sample is executed in an instrumented virtual environment. Dynamic behavior is triggered based on emulated user interactions.

Malicious JS detection based on automated user interaction emulation

Techniques for rendering an object using multiple versions of an application in a single process for dynamic malware analysis are disclosed. In some embodiments, a system, process, and/or computer program product for rendering an object using multiple versions of an application in a single process for dynamic malware analysis includes receiving a sample at a cloud security service, in which the sample includes an embedded object; detonating the sample using a browser executed in an instrumented virtual machine environment; and rendering the embedded object using a plurality of versions of an application in a single process during a dynamic malware analysis using the instrumented virtual machine environment.

Rendering an object using multiple versions of an application in a single process for dynamic malware analysis

Rendering an object using muliple versions of an application in a single process for dynamic malware analysis

Various techniques for detection of malware that attempt to exploit a memory allocation vulnerability are disclosed. In some embodiments, a system, process, and/or computer program product for detecting an attempt to exploit a memory allocation vulnerability includes receiving a malware sample; monitoring an array operation performed by the malware sample using a memory monitoring component; and determining whether the array operation performed by the malware sample is suspicious. For example, an array operation, such as a vector operation performed by an application that is executed using an ActionScript virtual machine, can be monitored to detect any suspicious vector operations.

Growing community of inventors

Santa Clara, CA, United States of America

Tao Yan