KR20080047251A - Apparatus and method for detecting packed file - Google Patents

Abstract

A device and a method for detecting executable compression of an executable program are provided to detect the executable compression from a mutated PE(Portable Executable) file, the PE file having a modified or corrected file header, and the file having a knowledge executable compression pattern. An abnormal PE file format detecting module(42) checks over whether a target file is executable by including an executable file format, and checks a PE file section name and property of the executable file. An abnormal instruction checking module(44) determines whether an instruction moved to a memory range area of other section by checking the instruction of a section including an entry point of the doubtable executable file based on a checking result. An executable compression determining module(46) determines that the executable compression is applied to the target file when the instruction moving to the memory range area of other sections is found. The target file is provided from an external storing part(20) by a command of a key input part(10).

Description

Apparatus and method for detecting execution compression of executable program {APPARATUS AND METHOD FOR DETECTING PACKED FILE}

1 is a block diagram showing an embodiment of an apparatus for detecting the presence or absence of execution compression of an execution program according to the present invention;

Figure 2 is a flow chart showing step by step an embodiment of a method for detecting the presence or absence of execution compression of the execution program according to the present invention.

<Explanation of symbols for the main parts of the drawings>

10: key input unit

20: storage

30: display unit

40: program operating system

42: Abnormal PE file format detection module

44: abnormal instruction check module

46: execution compression determination module

The present invention relates to an apparatus and method for detecting the execution compression of an execution program, and more particularly, to an apparatus and a method for detecting the execution compression of an execution program by analyzing the execution program.

Execution compression is a commonly known method such as zip and rar. It was originally developed to reduce the size by compressing the file size using compression and encryption algorithms or to protect the program by reverse engineering. It is being exploited by malware authors to produce variants of malware. Execution compression method is different from the compression of data files such as zip and rar, and has the biggest purpose of compressing the execution file. There are a variety of executable and encryption programs known to date, and malware writers are using these kinds of programs to transform them, and various executable compression and encryption programs have been developed and released on the Internet. It is becoming. The most representative execution compression is UPX, ASPack, FSG, Telock, PECompact, WWPack32, EZip, Pex, JDPack, DoomPack, Mew, etc.For encryption programs, PE-Crypt, Yoda, PESpin, PE-Encrypter, VGCrypt, etc. These programs are freely distributed on the Internet, accessible to the general public, and there are thousands of executable compression programs all over the world. Conventionally, a method for detecting the execution compression of a known executable file was detected through a pattern matching method by collecting a pattern of a portion of the head of the executable compressed file. In this way, PEID is the most known program. However, this method has a lot of difficulties in detecting the presence or absence of execution compression when only a part of the file head portion is modified and modified.

The present invention has been made in view of the above-described problems, and an object of the present invention is to provide an apparatus and method for detecting execution compression of an execution program that detects the execution compression of the execution program by analyzing the execution program.

In order to achieve this purpose,

According to one embodiment of the present invention, an apparatus for detecting the execution compression of an executable program according to a command provided from a key input unit, and includes: an executable file format included in an inspection target file and executable name, and a PE file section name of the executable file. And an abnormal PE file format detection module for examining the characteristics. An abnormal instruction checking module that checks an instruction for a section in which an entry point of a suspect executable file exists and determines whether there is an instruction to move to a memory range region of another section; As a result of the determination, when there is an instruction to move to a memory range region of another section, it is provided that the execution compression determining module that determines whether the inspection target file is executable compression.

Preferably, the inspection target file may be provided according to a command of the key input unit from an external storage unit.

The executable file format may include an MZ header and a PE header.

The suspected executable file is an executable file including an executable file format in the inspection target file. The executable file format may include an MZ header and a PE header.

The suspect executable file is an executable file with an abnormal section name of the PE file of the executable file in the file to be scanned.

The suspicious executable file is preferably an executable file having two or more sections that can be read / write / executed from the inspection target file.

Preferably, the instruction check is performed through disassembly on the section in which the entry point exists.

The memory range area of the other section may be a memory range area of another section having read / write / execute characteristics.

According to another aspect of the present invention, a method for detecting the presence or absence of execution compression in a device that detects the execution compression of an execution program according to a command provided from a key input unit, includes: (a) Executable file format is included in a file to be scanned; Checking whether it is executable, the PE file section name and attributes of the executable file; (b) if the abnormal result of the PE file format exists, inspecting an instruction for a section in which an entry point of a suspect executable file exists, and determining whether there is an instruction to move to a memory range region of another section. ; and (c) determining that the file to be inspected is compressed when there is an instruction to move to a memory range area of another section as a result of the determination.

Preferably, the executable file format includes an MZ header and a PE header.

The suspected executable file is an executable file including an executable file format in the inspection target file. The executable file format may include an MZ header and a PE header.

The suspect executable file is an executable file with an abnormal section name of the PE file of the executable file in the file to be scanned.

The suspect file may be an executable file having two or more sections that can be read / write / executed from the inspection target file.

The instruction check may be performed by disassembling the section in which the entry point exists.

The memory range area of the other section is preferably a memory range area of another section having read / write / execute characteristics.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating an embodiment of an apparatus for detecting execution compression of an execution program according to the present invention, and includes a key input unit 10, a storage unit 20, a display unit 30, and a program operating system 40. .

In the figure, the key input unit 10 may be composed of a keyboard, a mouse, or the like, and provides a command to the program operating system 40 to perform detection of the execution compression of the execution program based on a user's operation. do.

The program operating system 40 reads a test target file corresponding to the execution compression detection command provided from the key input unit 10 from the storage unit 20. The program operating system 40 performs the execution compression detection on the inspection target file read from the storage unit 20. The program operating system 40 displays each operation state of the program and its operation result on the display unit 30 so that a user can view each operation state of the program operating system 40 and the operation result thereof. The storage unit 20 may be configured as a CD-ROM drive, an HDD, or the like.

An example in which the program operating system 40 performs detection of the presence or absence of execution compression of a corresponding execution program is as follows.

First, the abnormal PE file format detection module 42 in the program operating system 40 is executed by including the executable file format MZ header and PE header in the file to be inspected provided based on a user's command from the storage unit 20. Check the PE file section name and attributes of the executable, if possible. The program operating system 40 starts a program for detecting the presence or absence of execution compression of an execution program according to the present invention based on a user's command through the key input unit 10.

Abnormal instruction check module 44 reads / writes / executes an instruction by performing disassembly on a section where an entry point of a suspect executable file exists as a result of a check of abnormal PE file format detection module 42. It is determined whether there is an instruction to move to a memory range region of another section having a characteristic. The suspicious executable file is an abnormal PE file format detection module 42, and when the scan target file includes an executable file format, MZ header and PE header, or is executable or abnormal section of the PE file of the executable file. This is the executable file when there is more than one section with a name or read / write / executable.

The execution compression determination module 46 determines that the file to be scanned is executable and compressed when there is an instruction to move to a memory range of another section having read / write / execution characteristics as a result of the abnormal instruction inspection module 44. To judge.

2 is a flow chart showing step by step an embodiment of a method for detecting the presence or absence of execution compression of an execution program according to the present invention.

First, the abnormal PE file format detection module 42 in the program operating system 40 includes the executable file format MZ header and PE header included in the inspection target file provided based on a user's command from the storage 20. Whether or not, the PE file section name and characteristics of the executable file are checked (S10).

Abnormal instruction checking module 44 detects an instruction by performing disassembly on a section in which an entry point of a suspect executable file exists when an abnormal PE file format detection module 42 detects an abnormal PE file format. In operation S12 and S14, it is determined whether there is an instruction for moving to a memory range region of another section having read / write / execute characteristics. The suspicious executable file is an abnormal PE file format detection module 42, and when the scan target file includes an executable file format, MZ header and PE header, or is executable or abnormal section of the PE file of the executable file. This is the executable file when there is more than one section with a name or read / write / executable.

The execution compression determination module 46 determines that the file to be scanned is executable and compressed when there is an instruction to move to a memory range of another section having read / write / execution characteristics as a result of the abnormal instruction inspection module 44. It judges (S16, S18).

The present invention primarily analyzes an executable file to find an executable file format, follows the PE format specification according to the general PE file structure, and examines the section name to see if it is executable. To be detected. Here, PE stands for Portable Executable, which is the basic file format of Win32. The PE format is split off from the Unix common object file format (Coff), meaning "Portable Executable" means that it can be used commonly under the Win32 platform. All Win32 executables (except VxD and 16-bit DLLs) are PE The file format is used, and the NT kernel is also loaded using the PE file format. In addition, the PE section here means code or data, and according to the PE format specification, each section has a unique distinguished name, and after a normal compilation process, each section has a name of TEXT, DATA, RDATA, EDATA, IDATA, and so on. Section names can be specified. In this first step, it checks whether there are more than one section of executable code and whether there is an executable file with more than one PE file in one executable file.

Secondly, if a suspicious portion is found in the primary scan, the instruction is examined by disassembly within the scope of the section where the executable entry point exists, reading out of the address space of the section where the entry point exists. It checks if there is a move to the memory range of another section with write and executable characteristics, and if so, determines that it is finally compressed. Most executable compression compresses and encrypts the original file into data and stores it in different sections. When the actual executable compressed program is run, the compressed / decrypted portion of the data is compressed / decrypted and then the program's execution control and The flow has a unique characteristic of moving to the original entry point.

In the present invention, the program operating system 40 may be regarded as an embodiment of an apparatus for detecting the presence or absence of execution compression of an execution program.

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form.

The present invention described above is not limited to the above-described embodiment and the accompanying drawings, and various substitutions, changes, and conversions can be made without departing from the spirit of the invention. It will be apparent to those who have knowledge.

The present invention primarily detects an executable file format by statically analyzing an executable file, finds an executable file format, conforms to the PE format specification according to the general PE file structure, and examines the section name to see if it is executable and detects it as a suspicious file with an abnormal section name or structure. do.

Secondly, if a suspicious portion is found in the primary scan, the instruction is examined by disassembly within the scope of the section where the executable entry point exists, reading out of the address space of the section where the entry point exists. It checks if there is a move to the memory range of another section with write and executable characteristics, and if so, determines that it is finally compressed.

Therefore, it is possible to detect the presence or absence of execution compression even for a variant of an execution compression program, a modification or modification of a file head, or an unknown execution compression type file.

Claims (17)

A device for detecting the presence or absence of execution compression of an executable program according to a command provided from a key input unit, An abnormal PE file format detection module that checks whether an executable file format is executable and included in the scan target file, and a portable executable file section name and characteristics of the executable file; An abnormal instruction checking module that checks an instruction for a section in which an entry point of a suspect executable file exists and determines whether there is an instruction to move to a memory range region of another section; And an execution compression determining module for determining whether the inspection target file is executable or compressed if an instruction to move to a memory range region of another section exists as a result of the determination. The method according to claim 1, And the inspection target file is provided according to a command of the key input unit from an external storage unit. The method according to claim 1, And the executable file format includes an MZ header and a PE header. The method according to claim 1, And the executable file in question is an executable file of the executable program, wherein the executable file includes an executable file format in the scan target file. The method according to claim 4, And the executable file format includes an MZ header and a PE header. The method according to claim 1, The suspicious executable file is an executable compression detection device of an executable program, characterized in that the executable file having an abnormal section name of the PE file of the executable file in the scan target file. The method according to claim 1, The suspicious executable file is an executable compression detection device of an executable program, characterized in that the executable file includes two or more sections that can be read / write / executed from the scan target file. The method according to claim 1, And detecting the execution compression of the execution program, wherein the instruction check is performed by disassembling the section in which the entry point exists. The method according to claim 1, And a memory range region of the other section is a memory range region of another section having read / write / execute characteristics. A method for detecting the presence or absence of execution compression in a device that detects the execution compression of an execution program according to a command provided from a key input unit, (a) checking whether the file to be scanned includes an executable file format and is executable, the PE file section name and characteristics of the executable file; (b) if the abnormal result of the PE file format exists, inspecting an instruction for a section in which an entry point of a suspect executable file exists, and determining whether there is an instruction to move to a memory range region of another section. ; and (c) determining that the inspection target file is executable and compressed if there is an instruction to move to a memory range region of another section as a result of the determination. The method according to claim 10, The executable file format detecting method according to the execution compression of the executable program, characterized in that it comprises a MZ header and a PE header. The method according to claim 10, And the executable file in question is an executable file including an executable file format in the scan target file. The method according to claim 12, The executable file format detecting method according to the execution compression of the executable program, characterized in that it comprises a MZ header and a PE header. The method according to claim 10, The suspicious executable file is an executable file detection method of an executable program, characterized in that the executable file having an abnormal section name of the PE file of the executable file. The method according to claim 10, The suspicious executable file is an executable compression detection method of an executable program, characterized in that the executable file includes two or more sections that can be read / write / executed from the scan target file. The method according to claim 10, And detecting the execution compression of the execution program, wherein the instruction check is performed by disassembling the section in which the entry point exists. The method according to claim 10, And a memory range region of the other section is a memory range region of another section having read / write / execute characteristics.

Images