KR20090129609A - Apparatus and method for checking virus program by distinguishing compiler - Google Patents

Abstract

PURPOSE: A malicious code diagnostic device using diagnosis data classified into each compiler and a method thereof are provided to efficiency reduce a malicious code diagnostic time by remarkably reducing a comparison frequency of the diagnostic data. CONSTITUTION: A PE(Portable Executable) file collector(300) collects a PE files, which are a target for checking a malicious code in a computer. A compiler classifier(302) classifies compilers by analyzing the compiler generating each collected PE file. A diagnostic unit(304) diagnoses the malicious code from the collected PE files by using diagnostic data set to each classified compiler.

Description

Apparatus and method for diagnosing malware by compiler classification {APPARATUS AND METHOD FOR CHECKING VIRUS PROGRAM BY DISTINGUISHING COMPILER}

The present invention relates to a method for diagnosing malicious code for an executable file executed on a computer. In particular, a PE (Portable Executable) file of an executable file executed on a computer is classified for each compiler and using diagnostic data established for each compiler. The present invention relates to an apparatus and method for diagnosing malicious codes by distinguishing PE compilers that enable faster malware inspection.

Typically, executables that run on a Windows OS are independently loaded into memory and are defined in the form of a Portable Executable (PE) file in the form of CPU execution. These executable files are implemented using a programming language (C, C ++, Pascal, Java, Basic, etc.), and the files implemented through the programming language are again Visual C ++, Visual Basic, Delphi, C ++. It is produced as binary data in PE file format through compilers such as Builder and Builder.

On the other hand, Windows-based malware consists of programmed PE files, and anti-virus companies distinguish PE files from other MZ (DOS OS executable) files or NE (Unix OS executable) files. Malware and normal code are diagnosed by extracting diagnosis algorithm and data according to format.

That is, in the conventional general malware diagnosis algorithm, the characteristics of the PE header and the code of execution start position, the characteristics of the last section or section of the PE file, and the size and path of the PE file are provided through a hash of the entire PE file. Diagnose malicious code by extracting diagnostic data such as name, MD5, etc.

However, in the conventional malware inspection using the above-described PE file, as shown in FIG. 1, for example, if there are 10000 diagnostic data to be checked, 10000 diagnostic data are compared with each PE file. As a result, the scan time for diagnosing the malicious code takes too much time and was not efficient.

The present invention described above is a device for diagnosing malware by compiler classification, and includes a PE file collecting unit for collecting PE files of executable files to be scanned for malicious code on a computer, and a PE file collected by the PE file collecting unit. A compiler classification unit that analyzes the compiler generating each PE file and classifies the compiler into compilers, a diagnosis unit that checks whether malicious code is detected by using diagnostic data established for each compiler, for the PE files classified from the compiler classification unit; Comprising a diagnostic data DB for storing the diagnostic data for each compiler for compiler-specific malware inspection for the PE file, the diagnostic unit, for each PE file classified by the compiler, the entry point value, project information value, Each diagnostic data stored in advance for each compiler for extracting user function value and determining malicious code Compare with and match the malicious code characterized in that judging.

In addition, the present invention is a method for diagnosing malware by compiler classification, the step of collecting the PE file of the executable file activated on the computer for the malicious code check, and each PE file for the collected PE files Classifying each compiler by analyzing the generated compiler, and diagnosing the presence of malicious codes using diagnostic data established for each compiler for the PE files classified by the compiler. Extracting an entry point value, a project information value, and a user function value for each classified PE file, and comparing the extracted values with the first, second, and third diagnostic data previously stored for each compiler; And diagnosing with a malicious code when each of the extracted values matches the respective diagnostic data. And a gong.

In the present invention, in the malware diagnosis of the executable files running on the computer, after classifying the PE file by compiler, by performing the malware diagnosis using the diagnostic data established for each compiler, the number of comparison with the diagnostic data Significantly reduced, there is an advantage that can shorten the time for more efficient malware diagnosis.

In addition, considering the recent increase in production by changing variables or strings using the same project and source due to the characteristics of malicious codes, it is necessary to select various user function values again when comparing diagnostic data with respect to user function values. By performing the diagnosis, the modified malicious code for the same project generated by the same compiler can be found, thereby increasing the reliability of the malware diagnosis.

Therefore, in the present invention, a malware diagnosis apparatus according to the PE compiler classification to divide the PE file of the executable file running on the computer by compiler and to perform the malicious code inspection more quickly using the diagnostic data established for each compiler and To provide a method.

Hereinafter, with reference to the accompanying drawings will be described in detail the operating principle of the present invention. In the following description of the present invention, when it is determined that a detailed description of a known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. Terms to be described later are terms defined in consideration of functions in the present invention, and may be changed according to intentions or customs of users or operators. Therefore, the definition should be made based on the contents throughout the specification.

FIG. 2 is a diagram illustrating a concept of diagnosing malware based on the classification of a PE compiler according to an embodiment of the present invention. As shown in FIG. 2, diagnostic data of each compiler is generated for a PE file generated by various compilers. After subdividing into groups and checking malicious code by compiler, the number of diagnostic data comparisons is reduced several times than that of single PE-based diagnostic data as shown in FIG. The time can be significantly reduced.

That is, as shown in FIG. 2, when the PE file is divided by compiler, assuming that the diagnostic data for each compiler is 2500, the number of comparisons of the diagnostic data by the compiler that divided the PE file is 2500 times. This means that the inspection time is reduced by 4 times compared to 10000 comparisons per PE file. In the example of FIG. 2, examples of Visual C ++, Visual Basic, C ++, Builder, Delphi, etc., which are mainly used as compilers, are assumed, and it is assumed that all have the same size of diagnostic data.

3 illustrates a module configuration of an apparatus for diagnosing malware by PE compiler classification according to an embodiment of the present invention. The above malware diagnosis device is a functional module of the antivirus program developed by an antivirus company and installed on a computer.

Hereinafter, the operation of each module of the malware diagnosis apparatus of the present invention will be described in detail with reference to FIG. 3.

First, the PE file collection unit 300 collects the PE files of the executable files for malware inspection from the executable files such as EXEs and DLLs that are activated and executed on a computer.

The compiler classification unit 302 analyzes a compiler that generates each PE file with respect to the PE file collected by the PE file collecting unit 300 and classifies the compiler by compiler. The above PE file is binary data composed of machine language. It is produced by various compilers such as Visual C ++, Visual Basic, C ++, Builder, Delphi, etc. All PE files show the structural characteristics by their compiler characteristics. In other words, in the .Text section of the executable file of the PE file, the compiler has its own characteristic information such as the information and structure of the native compiler, the information of the project, the link information about the resources, and the native code of the compiler itself.

Among the information of these unique compilers, basic information of the entire program, such as project information, exists, and the structure, principle, and components of the project are different for each compiler, but the basic characteristics are the same. Therefore, the above project information can be used as independent data to distinguish PE files derived from the same compiler. That is, the compiler classification unit 302 analyzes project information existing in the executable code of the PE file to configure the structure of the PE file, internal machine language, resources, import libraries, and each compiler. By checking the stubcode of the program, the compiler checks which compiler the PE file is generated and classifies by compiler.

The diagnosis unit 304 extracts an entry point value, a project information value, and a user function value for each PE file classified by the compiler from the compiler classification unit 302 to diagnose the diagnosis. Compared with the corresponding diagnostic data stored for each compiler in the data base 306, the malicious code is diagnosed.

That is, the diagnostic unit 304 extracts an entry point value indicating the start point of execution code in the header of the PE file and compares it with the first diagnostic data which is a set of PE file entry point values previously known as malware of the corresponding compiler. Check for match. In addition, the project information value including the compiler characteristic information in the executable code of the PE file is extracted and compared with the second diagnostic data, which is a set of project information values for the PE file known as the malicious code of the compiler, to check for a match. .

In addition, the diagnosis unit 304 is configured to generate the target PE file based on the file offset position and the function size of the user function existing in the diagnosis data DB 306 from the first diagnosis data and the second diagnosis data of the PE file. 3, the user function OPcode value, which is diagnostic data, is calculated and compared with the third diagnostic data user function OP code value of the diagnostic data DB 306 to check whether there is a match.

In this case, the diagnosis unit 304 may determine that the user function OP code value calculated by the function size from the position of the user function file offset present in the diagnosis data DB 306 is the third diagnosis data of the diagnosis data DB 306. If the OP code value does not match, the project structure in the executable code of the PE file is analyzed to diagnose the modified malicious code, and the largest or smallest file size among the user functions inserted in the executable code, or the function located first Alternatively, the last function is searched, and one function is arbitrarily selected to obtain a user function value, and then the third diagnostic data is compared again.

4 is a flowchart illustrating an operation control flow for diagnosing malicious code by classifying compilers according to an embodiment of the present invention. Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 3 and 4.

First, when the anti-malware diagnosis apparatus of the present invention on the computer is activated, the PE file collection unit 300 in the malware diagnosis apparatus is executed executable files, such as EXE, DLL, etc. executed on the computer in step (S400) Collect PE files from. Subsequently, the compiler classification unit 302 analyzes project information on the PE files collected through the PE file collection unit 300 in step S402 to classify each PE file by compiler.

As described above, when collecting and classifying compiler-specific PE files to be executed on the computer is performed by the compiler, the diagnostic unit 304 establishes each compiler file for each PE file while performing steps (S404) to (S408). Malware detection is performed using the diagnostic data.

That is, the diagnostic unit 304 extracts the AddressOfEntryPoint field value present in the image optional header structure in the inspection target PE file in step S404, and as shown in FIG. Extract to the entry point value that is the start of execution. Thereafter, the diagnosis unit 304 compares the entry point value of the extracted PE file to be examined with the first diagnostic data, which is a set of PE file entry point values previously known as malware of the corresponding compiler, and checks whether there is a match. .

Subsequently, the diagnosis unit 304 extracts a project information value including compiler characteristic information in the execution code of the PE file in step S406. In this case, the above project information may be represented by a structure, etc. The diagnostic unit 304 hashes a specific value of the corresponding structure by using a predetermined n-byte value, as shown in FIG. 5, using an encryption scheme such as MD or CRC. For example, a unique 4-byte value is used. The diagnosis unit 304 compares the project information value of the extracted test target PE file with the second diagnostic data, which is a set of project information values for the PE file previously known as the malicious code of the corresponding compiler, and checks whether there is a match. .

Subsequently, the diagnosis unit 304 extracts a user function value inserted into the executable code of the PE file in operation S408 and compares the result with the third diagnostic data which is a set of user function values previously known as malware of the corresponding compiler. Check it. In this case, the value of the user function means the relevant data for the function inserted by the user in the executable code of the PE file. As shown in FIG. 5, the file offset value, the function size value, User function OP code value from the file offset to the function size.

The file offset value, which is the first of the above user function values, may be arbitrarily selected as, for example, the largest function of the user function, the smallest of the user functions, or the function located at the first file offset of the user functions. . After the user function is selected as above, the function size value of the user function is extracted as the second value of the user function value, and the OP code value as much as the function size is extracted from the file offset as the third value of the user function value. At this time, the file offset value, the function size value, and the OP code value for the user function value are made into n-byte values that are predetermined by encryption methods such as hash, MD5, CRC, for example, unique 4-byte values.

In addition, the diagnostic unit 304 is a user of the PE file as much as the size of the function at the user function file offset position of the third diagnostic data from the diagnostic data record in which the first diagnostic data and the second diagnostic data of the diagnostic data DB 306 match. The function OP code value is calculated and compared with the user function OP code value of the third diagnostic data. If it does not match, the diagnosis unit 304 analyzes the project structure in the executable code of the PE file to diagnose the modified malicious code, and has the largest or smallest file function among the user functions inserted in the executable code or the first. The first function or the last function is searched, and one function is arbitrarily selected to obtain a user function value, and then compared with the user function OP code value, which is the third diagnostic data. This makes it possible to diagnose various variants of malware in the same project for the same compiler.

As described above, the diagnostic unit 304 performs a comparison between the unique diagnostic value for checking the malicious code extracted into the PE file and the diagnostic data established for each compiler through the steps S404 to S408, and then checks the target PE. If the unique diagnostic value extracted from the file matches the corresponding diagnostic data for each compiler, the process proceeds from step S410 to step S412 to diagnose the PE file as malicious code. Then, the diagnostic unit 304 proceeds to step (S414) to block the execution of the malware program on the computer by deleting the virus or if it is impossible to clean the executable file containing the PE file diagnosed as malicious code It is to be made.

FIG. 6 is a flowchart illustrating a process of setting diagnostic data and a malicious code diagnosis process in a visual basic compiler, in particular, during a malicious code diagnosis process according to a compiler classification according to an embodiment of the present invention. Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 3, 4, and 6.

First, the PE file generated by the Visual Basic compiler has a structured .Text section based on an object-oriented program (OOP), which provides general information about the executable and user function information. Every Visual Basic program has four important structure information based on a project structure called VB_HEADER: PROJECT_INFO, GUI_OBJECT, COMPONENT, and COM_REG_DATA. The project information (PROJECT_INFO) structure contains information about the objects of Visual Basic that are actually contained, and each object links information about a control or a method.

As shown in FIG. 7, the diagnosis data of the Visual Basic compiled PE file is divided into P data type diagnostic data and Native type diagnostic data according to the code characteristics of the PE file execution code. In addition, P code is a stack-based virtual engine's OP code in Visual Basic's virtual machines (MSVBVM50.DLL and MSVBVM60.DLL), which is distinct from the x86 CPU family of registers and stack-based native code.

That is, the diagnostic unit 304 extracts an entry point value, which is information about a start point of the code of the PE file, in step S600 for a PE file classified as compiled in visual basic, and in step S602, visual basic compilation. The first diagnostic data, which is an entry point value previously known as malicious code, is checked in the PE file.

At this time, when the entry point value, which is the code start time information of the test target PE file, and the first diagnostic data do not match, the diagnostic unit 304 proceeds from step S602 to step S604 to perform malicious code on the corresponding PE file. Diagnose not

However, when the entry point value, which is the code start time information of the inspection target PE file, and the first diagnosis data coincide, the diagnosis unit 304 proceeds from operation S602 to operation S606 to execute the execution code of the inspection target PE file. Project information including the characteristic information of the Visual Basic compiler is extracted, and in step S608, it is checked whether the Visual Basic compiled PE file is consistent with the second diagnostic data which is a project information value known as a malicious code. At this time, the above project information value is the n-byte value that is set by using encryption method such as hash, MD5, CRC, etc., for example, specific unique data information of the VB_HEADER structure which is the project information structure for the Visual Basic executable file. It will be made into a 4-byte value.

At this time, if the project information value of the inspection target PE file and the second diagnostic data does not match, the diagnostic unit 304 proceeds from step S608 to step S604 to diagnose that the PE file is not malicious code. .

However, when the project information value of the inspection target PE file and the second diagnostic data match, the diagnostic unit 304 proceeds from step S608 to step S610 to extract user function values in the PE file. It is checked whether the executable code is written in any code, and in operation S612, a file offset value of the user function for extracting the user function value according to the executable code characteristic of the PE file is calculated.

Subsequently, the diagnostic unit 304 proceeds to step S614 and calculates an offset value in the PE file execution code in which the user function is located according to the execution code characteristics of the PE file to be examined to extract the user function value.

That is, a PE file compiled with Visual Basic may be generated with different kinds of code as P code or Native code in generating the execution code. Therefore, when extracting the user function value from the Visual Basic compiled PE file, it is necessary to extract the user function value according to whether the Visual Basic compiled executable code of the target PE file is generated in P code or Native code. The file offset value must be set differently.

For example, if a PE file compiled with Visual Basic is generated in P code, the diagnostic unit 304 may generate the largest or smallest function or the first from the user functions obtained through the project structure for the Visual Basic executable. For the user function selected by the appropriate user function selection algorithm such as the located function or the last function, the file offset value and the function size value of the starting point of the user function are obtained, and the OP code data of the function size from the file offset is hashed, MD5, It extracts n-byte values, that is, 4-byte unique data values, which are preset by an encryption method such as CRC.

In contrast, when a PE file compiled with Visual Basic is generated as native code, the diagnosis unit 304 may have the largest or smallest function, the first or last function, or the last function from user functions obtained through the project structure. For the user function selected by the appropriate user function selection algorithm, obtaining the file offset value and the function size value of the starting point of the user function is performed in the same way as in the P code method. Data extracted from only the first data of the OP code data is extracted as a predetermined n-byte value, that is, a 4-byte unique data value by an encryption method such as hash, MD5, CRC, or the like.

At this time, in extracting the user function value of the PE file compared with the third diagnostic data, the VB file is divided into an EXE or a DLL, a P code or a native code, a form or a module, and a file offset of the user function due to the characteristics of the VB compiler. The value can vary. Therefore, the user function value is extracted by considering not only the file offset value of the user function according to the difference between the P code and the native code, but also the characteristics of an EXE or DLL, a P code or a native code, a form, or a module.

Subsequently, the diagnostic unit 304 visually makes the user function value extracted from the PE file to be inspected in step S616 into an n-byte value, that is, a 4-byte diagnostic value, which is preset by an encryption method such as hash, MD5, CRC, or the like. In the basic compiled PE file, it is checked whether it matches the third diagnostic data known as malware.

At this time, if the user function value extracted from the PE file to be examined matches the third diagnostic data previously known as malicious code in the Visual Basic compiled PE file, the diagnostic unit 304 proceeds to step S624 and the corresponding test object. Diagnose PE file as malware.

On the contrary, if the user function value extracted from the inspection result PE file (S616) does not match the third diagnosis data previously known as malicious code in the Visual Basic compiled PE file, the diagnosis unit 304 In step S618, the user function selection algorithm is applied again to select another user function in the PE file to be examined.

Next, the diagnostic unit 304 extracts a user function value from the corresponding user function in step S620, and then n-byte value, that is, 4 bytes, preset by an encryption method such as hash, MD5, CRC, etc. in step S622. The diagnostic value is re-checked to match the third diagnostic data known as malicious code in the Visual Basic compiled PE file. This allows you to find modified malware for the same project generated by the same compiler.

Then, the diagnostic unit 304 proceeds to step S624 when the user function value extracted from the PE file to be inspected coincides with the third diagnostic data previously known as malicious code in the Visual Basic compiled PE file. Diagnose the target PE file as malicious code. However, unlike this, if the user function value extracted again from the inspection target PE file (S622) does not match the third diagnostic data previously known as malicious code in the Visual Basic compiled PE file, the diagnosis unit 304 Proceeds to step S604 to diagnose that the PE file is not malicious code.

As described above, in the present invention, in the diagnosis of malicious codes for executable files executed on a computer, the PE files are classified by compilers, and then the malicious codes are diagnosed using the diagnostic data established for each compiler. The number of comparisons can be significantly reduced, which can shorten the time for malicious code diagnosis more efficiently. In addition, considering the recent increase in production by changing variables or strings using the same project and source due to the characteristics of malware, by performing various diagnostics while selecting various user function values when comparing diagnostic data on user function values, Modified malware for the same project generated by the same compiler can also be found, increasing the reliability of malware diagnosis.

Meanwhile, in the above description of the present invention, specific embodiments have been described, but various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the invention should be determined by the claims rather than by the described embodiments.

1 is a conceptual diagram of a conventional PE file malware diagnosis,

2 is a conceptual diagram of malicious code diagnosis according to PE compiler classification according to an embodiment of the present invention;

3 is a block diagram of an apparatus for diagnosing malware by compiler classification according to an embodiment of the present invention;

4 is an operation control flowchart for diagnosing malicious code by classifying a compiler according to an embodiment of the present invention;

5 is a diagram illustrating intrinsic diagnostic values according to characteristics of each compiler according to an embodiment of the present invention;

6 is a flowchart illustrating a malware diagnosis process of a Visual Basic compiled PE file according to an embodiment of the present invention;

7 is a diagram illustrating intrinsic diagnostic values according to characteristics of a visual basic compiler according to an embodiment of the present invention.

<Brief description of the major symbols in the drawings>

300: PE file collection unit 302: compiler classification unit

304: diagnostic unit 306: diagnostic data DB

Claims (49)

As a malware diagnosis device by compiler classification, PE file collection unit for collecting the PE files of the executable files to be scanned for malicious code on the computer, Compiler classification unit for analyzing the compiler for generating each PE file with respect to the PE file collected by the PE file collection unit and classifies by compiler, Diagnosis unit for checking the malicious code for the PE files classified by the compiler classification unit using the diagnostic data established for each compiler Malware diagnosis apparatus by the compiler classification, including. The method of claim 1, The malware diagnosis device, Diagnostic data DB that stores diagnostic data for each compiler to check malware for each compiler for the PE file Malware diagnosis apparatus by the compiler classification, characterized in that it further comprises. The method of claim 1, The diagnostic unit, For each PE file classified by the compiler, an entry point value, a project information value, and a user function value are extracted and compared with each diagnostic data previously stored for each compiler to determine the malicious code. Malware diagnosis apparatus by the compiler classification, characterized in that. The method of claim 3, wherein The diagnostic unit, An apparatus for diagnosing malware according to compiler classification, comprising: extracting an entry point value indicative of a start point of execution code in a header of the PE file and comparing it with first diagnostic data of a corresponding compiler; The method of claim 4, wherein The first diagnostic data, A set of PE file entry point values previously known as compiler-specific malware, and the malware diagnosis apparatus according to the compiler classification, characterized in that compared with the entry point value of the PE file to be inspected. The method of claim 3, wherein The diagnostic unit, The apparatus for diagnosing malware according to compiler classification, comprising: extracting a project information value including compiler characteristic information in executable code of the PE file and comparing it with second diagnostic data of a corresponding compiler; The method of claim 6, The second diagnostic data is, A device for diagnosing malware according to a compiler classification, wherein a set of project information values for a PE file known as malware for each compiler is compared with project information values of the PE file to be inspected. The method of claim 3, wherein The diagnostic unit, The apparatus for diagnosing malware according to compiler classification, comprising: extracting a value of a user function inserted into an execution code of the test target PE file and comparing it with third diagnostic data of a corresponding compiler. The method of claim 8, The diagnostic unit, Analyzing the project structure in the executable code of the PE file to obtain a user function value by selecting the largest or smallest file size or the first position or the last function among the user functions inserted into the executable code Malware diagnosis device by compiler classification. The method of claim 9, The diagnostic unit, Obtaining a file offset value and a file size value of a starting point of the selected user function, and calculating a user function OP code value corresponding to the file size from the file offset to obtain a user function value for comparison with the third diagnostic data. Malware diagnosis apparatus by distinguishing the compiler. The method of claim 10, The diagnostic unit, If the user function value extracted from the selected user function does not match the third diagnostic data, select another user function inserted in the execution code of the PE file and perform comparison with the third diagnostic data again. Malware diagnosis device by compiler classification. The method of claim 8, The third diagnostic data is, A set of user function values for PE files known in advance as malware for each compiler, and the malware diagnosis apparatus according to compiler classification, characterized in that compared with the user function values of the PE file to be inspected. The method of claim 3, wherein The project information value and the user function value, An apparatus for diagnosing malware according to a compiler classification, which is generated with a preset n-byte value by a preset encryption method and compared with each diagnostic data. The method of claim 13, The n byte value is Malware diagnosis apparatus according to the compiler classification, characterized in that the value generated by four bytes through the hash, MD5 or CRC method. The method of claim 1, The compiler classification unit, An apparatus for diagnosing malware according to a compiler classification, characterized in that the type of compiler that generates the PE file is determined by analyzing the project information in the executable code of the PE file. The method of claim 1, Compiler for generating the PE file, Visual Basic, Visual C ++, Delphi, C ++ or Builder malware diagnosis apparatus according to the compiler classification, characterized in that. The method of claim 1, The diagnostic unit, After extracting the entry point value and the project information value for the inspected PE file generated by the Visual Basic compiler among the compilers, the user function value is extracted to correspond to the executable code characteristics of the Visual Basic compiled PE file. The apparatus for diagnosing malware according to a compiler classification, characterized in that it compares with each of the previously stored diagnostic data for the judgment of the code, and determines the malicious code if the code matches. The method of claim 17, The diagnostic unit, A compiler for extracting an entry point value indicating a start time of an executable code in a header of the PE file and comparing it with first diagnostic data which is an entry point value previously known as a malicious code in the Visual Basic compiled PE file Malware diagnosis device by classification. The method of claim 17, The diagnostic unit, Extracting a project information value including the Visual Basic compiler characteristic information in the executable code of the PE file and comparing the extracted project information value with second diagnostic data which is a project information value known as malicious code in the Visual Basic compiled PE file Malware diagnosis device by compiler classification. The method of claim 17, The diagnostic unit, After checking whether the Visual Basic compiled executable code of the check target PE file is a P code or a native code, extracting a user function value inserted in the execution code of the check target PE file corresponding to the checked code type An apparatus for diagnosing malware according to a compiler classification, characterized by comparing with third diagnostic data of a Visual Basic compiler. The method of claim 20, The diagnostic unit, Analyze the project structure in the executable code of the Visual Basic compiled PE file and select the function having the largest or smallest file size, the first located function or the last function among the user functions inserted in the executable code. Malware diagnosis apparatus by the compiler classification, characterized in that obtained. The method of claim 21, The diagnostic unit, If the execution code of the PE file to be inspected is a P code, a file offset value and a file size value of a start point of the selected user function are obtained, and a user function OP code value corresponding to a file size is calculated from the file offset. 3 Malware diagnosis apparatus according to the compiler classification, characterized in that to obtain a user function value for comparison with the diagnostic data. The method of claim 21, The diagnostic unit, When the execution code of the PE file is a native code, the first data of the OP code among the OP code data corresponding to the file size from the start of the file offset of the selected function in calculating the OP code value among the user function values as the OP code value. Malware diagnosis apparatus by compiler classification, characterized in that the calculation. The method of claim 21, The diagnostic unit, If the user function value extracted from the selected user function does not match the third diagnostic data, select another user function inserted in the execution code of the PE file and perform comparison with the third diagnostic data again. Malware diagnosis device by compiler classification. The method of claim 22 or 23, The third diagnostic data is, And a set of user function values previously known as malicious codes of the Visual Basic compiled PE file, and compared with user function values of the PE file to be inspected, respectively. The method of claim 17, The project information value and the user function value, An apparatus for diagnosing malware according to a compiler classification, which is generated with a preset n-byte value by a preset encryption method and compared with each diagnostic data. The method of claim 26, The n byte value is Malware diagnosis apparatus according to the compiler classification, characterized in that the value generated by four bytes through the hash, MD5 or CRC method. As a method of diagnosing malware by compiler classification, Collecting PE files of activated executable files on the computer to check for malware; Analyzing the compilers that generate each PE file with respect to the collected inspection target PE files, and classifying the compiler by compiler; Diagnosing the presence of malicious code using diagnostic data established for each compiler for the PE files classified by the compiler Malicious code diagnostic method by the compiler classification, including. The method of claim 28, The diagnostic step, Extracting an entry point value, a project information value, and a user function value for each PE file classified by the compiler; Comparing each of the extracted values with first, second, and third diagnostic data stored in advance for each compiler; Diagnosing with malware when each value of the extracted data matches the respective diagnostic data Malicious code diagnostic method by the compiler classification, including. The method of claim 29, The entry point value is A method for diagnosing malicious code by distinguishing a compiler, which is present in a header of the test target PE file and indicates a starting point of execution code of the PE file. The method of claim 30, The first diagnostic data, A set of PE file entry point values previously known as compiler-specific malicious codes, and compared with an entry point value of the PE file to be inspected. The method of claim 29, The project information value, A method for diagnosing malicious code by classifying a compiler, which is present in the executable code of the test target PE file and includes compiler property information. The method of claim 32, The second diagnostic data is, A method for diagnosing malicious code by classifying a compiler, wherein the set of project information values for a PE file known as malware for each compiler is compared with the project information value of the PE file to be inspected. The method of claim 29, The user function value is, Compiler, which exists in the execution code of the PE file to be inspected, is a file offset value of the start point of the function inserted by the user, and a file size value and a user function OP code value corresponding to the file size from the file offset. Malware diagnosis method by classification. The method of claim 34, wherein The user function value is, Method for diagnosing malware by compiler classification, characterized in that the file size is obtained from one of the functions having the largest or smallest file size, the first located function or the last function among the user functions inserted into the execution code of the PE file to be scanned . 36. The method of claim 35 wherein The third diagnostic data is, A set of user function values for PE files known in advance as malware for each compiler, and the method for diagnosing malware by compiler classification, wherein the functions are compared with user function values of the PE file to be inspected. The method of claim 36, In the comparison step, If the user function value extracted from the selected user function does not match the third diagnostic data, another user function inserted in the execution code of the PE file is selected and compared with the third diagnostic data again. How to diagnose malware by compiler classification. The method of claim 29, The project information value and the user function value, A method of diagnosing malicious code by classifying a compiler, which is generated with a preset n-byte value using a preset encryption method and compared with each diagnostic data. The method of claim 38, The n byte value is Method of diagnosing malware by compiler classification, characterized in that the value is generated by 4 bytes through hash, MD5 or CRC method. As a method of diagnosing malware by compiler classification, Collecting PE files of executable files to be scanned for malicious code on a computer; Classifying the PE file generated by the Visual Basic compiler among the collected PE files; Extracting an entry point value, a project information value, and a user function value from the PE file generated by the Visual Basic compiler; Comparing the extracted values with first, second, and third diagnostic data of a visual basic compiler stored in advance to determine malicious codes; Diagnosing with malware when each value of the extracted data matches the respective diagnostic data Malicious code diagnostic method by the compiler classification, including. The method of claim 40, The entry point value is A value in the header of the PE file to be inspected and indicating a start point of execution code of the PE file, which is compared with first diagnostic data which is an entry point value previously known as malicious code in the Visual Basic compiled PE file. Malicious code diagnostic method by the compiler classification, characterized in that. The method of claim 40, The project information value, A value that is included in the executable code of the PE file to be inspected and includes the Visual Basic compiler characteristic information, and is compared with second diagnostic data which is a project information value known as malicious code in the Visual Basic compiled PE file. Malicious code diagnosis method by distinguishing compiler. The method of claim 40, The user function value is, A function inserted by a user in the executable code of the PE file to be inspected. When the Visual Basic compiled executable code of the PE file to be inspected is a P code, a file offset value and a file size value of the start point of the user function And a user function OP code value extracted as much as a file size from the file offset. The method of claim 40, The user function value is, A function inserted by a user in the executable code of the PE file to be inspected. When the Visual Basic compiled executable code of the PE file to be scanned is a native code, a file offset value and a file size of the start point of the user function A method of diagnosing malware by compiler classification, wherein the first data of the OP code is extracted as an OP code value among user function OP code data corresponding to a file size from a value and the file offset. The method of claim 43 or 44, The user function value is, Method for diagnosing malware by compiler classification, characterized in that the file size is obtained from one of the functions having the largest or smallest file size, the first located function or the last function among the user functions inserted into the execution code of the PE file to be scanned . The method of claim 45, The third diagnostic data is, And a set of user function values previously known as malicious codes of the Visual Basic compiled PE file, and compared with user function values of the PE file to be inspected, respectively. The method of claim 46, In the comparison step, If the user function value extracted from the selected user function does not match the third diagnostic data, another user function inserted in the execution code of the PE file is selected and compared with the third diagnostic data again. How to diagnose malware by compiler classification. The method of claim 40, The project information value and the user function value, A method of diagnosing malicious code by classifying a compiler, which is generated with a preset n-byte value using a preset encryption method and compared with each diagnostic data. 49. The method of claim 48 wherein The n byte value is Method of diagnosing malware by compiler classification, characterized in that the value is generated by 4 bytes through hash, MD5 or CRC method.

Images