PolyUnpack: Automating the Hidden-Code Extraction of Unpack-Executing Malware

By Paul Royal, Mitch Halpin, David Dagon, R. Edmonds, Wenke Lee. Asia-Pacific Computer Systems Architecture Conference, 2006

331 citations recorded by the source corpus.

Subfields: Information Systems, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/db9f9abd46ed75e727be2283a038ccc232feb688

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Software

In Signal Processing

Citations in the corpus

Automated Classification and Analysis of Internet Malware (2007, neutral): “[29] automates hidden-code extraction of unpack-executing malware.”
Effective and Efficient Malware Detection at the End Host (2009, background): “While generic unpackers [40] can sometimes help to obtain the actual instructions, binary analysis of obfuscated code is still very difficult [30].”
A Survey on Malware Detection Using Data Mining Techniques (2017, methodology): “For example, the packed malware can ﬁrst go through a dynamic analyzer such as PolyUnpack [Royal et al. 2006], where the hidden-code bodies of a packed malware instance are extracted by comparing the runtime execution of the malware instance with its static code model.”
CAMP: Content-Agnostic Malware Protection (2013, methodology): “A software publisher is identifi d by the public key of the signing certificate and the CA certifying it.”
BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection (2008, methodology): “8In an extreme case that bots update their binaries from different URLs (and the binaries are packed to be polymorphic thus different from each other), one should unpack the binary using tools such as Polyunpack [37] before calculating the distance.”
Renovo: a hidden code extractor for packed executables (2007, methodology): “Such techniques include binary and source code obfuscation [13, 22], control-ﬂow obfuscation [20], instruction virtualization [10], and binary code packing [27].”
AppSpear: Bytecode Decrypting and DEX Reassembling for Packed Android Malware (2015, background): “Polyunpack [20] performs automatic unpacking by emulating the execution of the program and monitoring all memory writes and instruction fetches, and considers all instructions fetched from previously written memory locations to be successfully unpacked.”
Automatic analysis of malware behavior using machine learning (2011, neutral): “Recently, several systems have been proposed to generically unpack malware samples (e.g., [14,37,54,57]).”
Opcode sequences as representation of executables for data-mining-based unknown malware detection (2013, methodology): “One solution to solve this obvious limitation of our malware detection method is the use of a generic dynamic unpacking schema such as PolyUnpack [63], Renovo [32], OmniUnpack [47] and Eureka [72].”
BitShred: feature hashing malware for scalable triage and semantic analysis (2011, background): “Our work builds on per-sample analysis and feature extraction, which is an extremely active area of research including unpacking research [18, 20, 27, 33, 35], and even entire conferences like DIMVA.”
Prevalence and Impact of Low-Entropy Packing Schemes in the Malware Ecosystem (2020, methodology): “(2) [32] Machine learning Same as [33] N-grams Not Packed: malware from MALFEASE project filtered with state-of-the-art unpackers ([37], [22]) Packed: malware from MALFEASE and benign executables”
A survey on automated dynamic malware-analysis techniques and tools (2012, background): “Royal et al. [2006] identify obfuscation techniques of unpackexecuting malware to hamper the work of malware detection tools.”
Classification of malware using structured control flow (2010, background): “Polyunpack (Royal et al. 2006) proposed a combination of static and dynamic analysis to dynamically detect code at runtime which cannot be identified during an initial static analysis.”
Dynamic Malware Analysis in the Modern Era—A State of the Art Survey (2019, methodology): “The analysis should start with removing any packing wrapper applied to the binary code to hide it from the analysis tool (a process called unpacking [92, 93, 94]).”
Ether: malware analysis via hardware virtualization extensions (2008, background): “Automated unpackers–common applications for ﬁne-grained analysis–include PolyUnpack [40] and Ren-ovo [32].”