악성 코드 내 난독화 된 윈도우즈 SDK API 호출에 대한 자동 분석

초록

API call obfuscation techniques hide dependency between Windows SDK API calls and whether or not to using the API for disturbing static analysis. In this paper, We propose automatic analysis method to find API redirect calls technique using dynamic taint analysis. First, we extract dynamic trace information such as instructions, memory access, API call from obfuscated malicious codes. Then we find instructions to depend on API using backward taint analysis. Using the information, we can recover addresses of original calling instructions. For experiment, we obfuscated malicious codes using “Import protection” technique in VMProtect. Then, we analyzed obfuscated malicious code using proposed method. The experiment results with the proposed method show a recovery rate of about 80～100%(average 91.6%) to find original API call addresses. We hope that proposed method will help finding code pattern and API dependency for analysis obfuscated malicious codes.

키워드