GENERAL UNPACKING OF APPLICATIONS FOR DETECTING MALICIOUS PROGRAMS Russian patent published in 2017 - IPC G06F21/56 

FIELD: information technology.

SUBSTANCE: method is implemented by executing computer-executable instructions on the storage medium to induce one or more processing units: to load the self-unpacking executable module into memory. Packed executable module is being unpacked. Attempt of recording is detected on the page of memory on which the code was previously executed by controlling access permissions to the page of memory using virtualization with hardware support. Completion of the unpacking of the packed executable module is detected through the first self-unpacking dummy module using one or more module heuristics. Scan of unpacked executable module is performed to detect a malicious program. In this case, one or more heuristics contain: a comparison of the stack pointer value and stack contents, recorded before the detection of the first self-unpacking fictitious module completion, with the stack pointer value and stack contents recorded before the first self-unpacking dummy module is allowed to begin unpacking the packed executable module.

EFFECT: detection of malicious program.

24 cl, 8 dwg