Benjamin C Cruz

US Patent:

20160292417, Oct 6, 2016

Filed:

Dec 23, 2014

Appl. No.:

15/038413

Inventors:

- Santa Clara CA, US
Vikas Taneja - Domlur, Bangalore, IN
Benjamin Cruz - Santa Clara CA, US

International Classification:

G06F 21/56
G06F 21/57

Abstract:

By hooking application programming interfaces in an execution environment, the return address for hooked application programming interface calls can be logged and used to determine when a packed binary has been unpacked. In one approach, memory allocations are detected and the return address is checked against the memory regions allocated. In another approach, the contents of memory at the return address in a pre-execution copy of the executable binary is compared with the contents of memory at the return address in the executing copy of the binary. This allows efficient detection of the completion of unpacking without knowledge of the unpacking technique. The unpacked binary may then be analyzed for possible malware.

US Patent:

20160094569, Mar 31, 2016

Filed:

Sep 25, 2014

Appl. No.:

14/496158

Inventors:

Stephen Mondiguing - Sunnyvale CA, US
Benjamin Cruz - San Francisco CA, US

International Classification:

H04L 29/06

Abstract:

In an example, a detection engine identifies potential malware objects according to behavior. In order to circumvent blacklists and fingerprint-based detection, a malware server may frequently change domain names, and change the fingerprints of distributed malware agents. A malware agent may perform only an initial DNS lookup, and thereafter communicate with the malware command-and-control server via “naked” HTTP packets using the raw IP address of the server. The detection engine identifies malware agents by this behavior. In one example, if an executable object makes repeated HTTP requests to an address after the DNS lookup “time to live” has expired, the object may be flagged as potential malware.