Detection of malicious modules injected on legitimate processes

• US 8,572,739 B1
• Filed: 10/27/2009
• Issued: 10/29/2013
• Est. Priority Date: 10/27/2009
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Cruz, Marvin Ubaldo, Rivera, Benjamin, Ang, Kerr Bryner, Perona, Michelle de la Pena
• Primary Examiner(s): Popham, Jeffrey D
• Assistant Examiner(s): BECHTEL, KEVIN M
• Application Number:
  US12/606,833
• Time in Patent Office: 1,463 Days
• Field of Search: 726 22- 25
• US Class Current: 726/24
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A computer includes modules that provide a shared library of functions callable by processes or other modules. A malicious module in the computer may be identified by enumerating modules needed by a process to operate. Modules currently loaded in the memory of the computer are also enumerated. A suspect or suspicious module may be identified as currently being loaded in the memory of the computer but not needed by a process to operate. The suspicious module may be deemed malicious (i.e., having malicious code, such as a computer virus) if the suspicious module does not export or provide a function for sharing to be called by other modules or process.

Claims

1. A computer-implemented method of detecting a malicious module in a computer, the method comprising:

the computer enumerating a first set of dynamic link libraries (DLLs) needed by a process running in the computer to operate, enumerating a second set of DLLs needed by a DLL in the first set of DLLs to operate, and enumerating a third set of DLLs needed by another DLL in the second set of DLLs to operate, the first, second, and third sets of DLLs being enumerated while the process is already running in the computer;

the computer enumerating a fourth set of DLLs, the fourth set of DLLs comprising DLLs of the process and of other processes that are currently loaded in a main memory of the computer;

the computer identifying a first DLL that is in the fourth set of DLLs but not in any of the first, second, and third sets of DLLs; and

the computer deeming the first DLL as malicious when the first DLL does not include a function that the first DLL exports to be callable by another DLL or process running in the computer.

2. The method of claim 1 wherein enumerating the first, second, and third sets of DLLs comprises:

the computer inspecting an import directory table of the process to identify the first set of DLLs; and

the computer inspecting an import directory table of each DLL in the first, second, and third sets of DLLs to identify additional sets of DLLs needed by the process to operate.

3. The method of claim 1 wherein the method is performed for all processes running in the computer.

4. The method of claim 1 wherein the first DLL includes a computer virus.

5. The method of claim 1 wherein deeming the first DLL as malicious comprises:

the computer checking an export directory table of the first DLL; and

the computer determining that the export directory table of the first DLL does not identify a function of the first DLL that is shared by the first DLL with another DLL or process running in the computer.

6. A computer having main memory, a processor, and a data storage device, the computer comprising:

a plurality of processes running in the main memory;

a plurality of dynamic-link libraries (DLLs) loaded from the data storage device and into the main memory, the plurality of DLLs being DLLs of the plurality of processes; and

a malicious module detector comprising computer-readable program code loaded from the data storage device to run in the main memory, the malicious module detector being configured to enumerate a first set of DLLs referenced by a first process in the plurality of processes, enumerate a second set of DLLs referenced by a DLL in the first set of DLLs, enumerate a third set of DLLs referenced by another DLL in the second set of DLLs, and identify a first DLL in the plurality of DLLs but not in any of the first, second, and third sets of DLLs, wherein the first DLL does not have a function called by a first process in the plurality of processes and the malicious module detector is configured to deem the first DLL as malicious when the first DLL does not identify a function that the first DLL shares with another DLL or process running in the computer.

7. The computer of claim 6 wherein the second set of DLLs is generated from an import directory table of the first process and import directory tables of DLLs enumerated in the import directory table of the first process.

8. The computer of claim 6 wherein the malicious module detector is further configured to identify a second DLL not having a function called by a second process in the plurality of processes.

9. The computer of claim 6 wherein the first DLL includes a computer virus.

10. The computer of claim 6 wherein the malicious module detector is configured to examine an export directory table of the first DLL to find that the first DLL does not export any function for use by other DLLs.