OmniUnpack: Fast, Generic, and Safe Unpacking of Malware

摘要: Malicious software (or malware) has become a growing threat as malware writers have learned that signature- based detectors can be easily evaded by "packing" the malicious payload in layers of compression or encryption. State-of-the-art adopted both static and dynamic techniques to recover pay- load packed malware, but unfortunately such are highly ineffective. In this paper we propose new technique, called OmniUnpack, monitor execution program real-time detect when removed various packing. OmniUnpack aids detection directly providing detector unpacked payload. Experimental results demonstrate effectiveness our approach. is able deal with known unknown packing algorithms introduces low overhead (at most 11% for benign programs).