GENERAL UNPACKING OF APPLICATIONS FOR DETECTING MALICIOUS PROGRAMS Russian patent published in 2018 - IPC G06F21/56 

FIELD: information technology.

SUBSTANCE: invention relates to means for detecting malicious programs in an executable module. Method of unpacking a self-extracting executable module to detect a malicious program contains: loading the self-extracting executable into memory containing the first unpacking dummy module and a packed executable; allowing the first unpacking dummy module to unpack the packed executable into an unpacked executable; detecting of an attempt to record on a memory page, code on which it was previously executed, by controlling access permissions to memory pages using virtualization with hardware support; detection of the completion of the first unpacking dummy module using one or more heuristics; and scanning the unpacked executable module to detect a malicious program, one or more heuristics contain a definition of whether an entry on the memory page that throws a page entry exception is written to the last page of a section of memory pages.

EFFECT: managed unpacking of a packed application regardless of the knowledge of the unpacking algorithm is provided.

25 cl, 8 dwg