Palo Alto Networks, Inc.

Tao Yan

Bo Qu

Jiangxia Liu

Taojie Wang

Jin Chen

ChienHua Lu

Zhanglin He

Zhibin Zhang

Edouard Bochin

Michael Harbison

Mengying Hu

Yue Guan

Various techniques for detecting obfuscated web skimmers based on encoding and hooking are disclosed. In some embodiments, a system/process/computer program product for detecting obfuscated web skimmers based on encoding and hooking includes receiving a sample; performing static analysis on the sample using encoded web skimmer detection rules (e.g., encoded using a plurality of encoding methods); performing dynamic analysis on the sample using hooking; and detecting an obfuscated web skimmer based on results of the static analysis using the encoded web skimmer detection rules and/or the dynamic analysis using hooking.

Detecting obfuscated web skimmers based on encoding and hooking

The present application discloses a method, system, and computer system for detecting Return Oriented Programming (ROP) exploits. The method includes (i) intercepting, by one or more processors, a memory attribute change function for a sample; (ii) determining if a return address is associated with a shellcode address, and (iii) in response to determining that the return address is associated with the shellcode address, determining that the sample is an ROP exploit.

Return address validation watchdog to discover ROP chains in exploits engineering cloud delivered security services (CDSS)

Detection of malicious JavaScript based on automated user interaction emulation is disclosed. A malware sample is executed in an instrumented virtual environment. Dynamic behavior is triggered based on emulated user interactions.

Malicious JS detection based on automated user interaction emulation

Techniques for rendering an object using multiple versions of an application in a single process for dynamic malware analysis are disclosed. In some embodiments, a system, process, and/or computer program product for rendering an object using multiple versions of an application in a single process for dynamic malware analysis includes receiving a sample at a cloud security service, in which the sample includes an embedded object; detonating the sample using a browser executed in an instrumented virtual machine environment; and rendering the embedded object using a plurality of versions of an application in a single process during a dynamic malware analysis using the instrumented virtual machine environment.

Rendering an object using multiple versions of an application in a single process for dynamic malware analysis

Rendering an object using muliple versions of an application in a single process for dynamic malware analysis

Various techniques for detection of malware that attempt to exploit a memory allocation vulnerability are disclosed. In some embodiments, a system, process, and/or computer program product for detecting an attempt to exploit a memory allocation vulnerability includes receiving a malware sample; monitoring an array operation performed by the malware sample using a memory monitoring component; and determining whether the array operation performed by the malware sample is suspicious. For example, an array operation, such as a vector operation performed by an application that is executed using an ActionScript virtual machine, can be monitored to detect any suspicious vector operations.

Growing community of inventors

Santa Clara, CA, United States of America

Tao Yan