{"id":188259,"date":"2012-08-09T00:00:00","date_gmt":"2012-08-16T14:20:33","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/research\/msr-research-item\/challenges-in-malware-analysis\/"},"modified":"2016-08-02T06:11:14","modified_gmt":"2016-08-02T13:11:14","slug":"challenges-in-malware-analysis","status":"publish","type":"msr-video","link":"https:\/\/www.microsoft.com\/en-us\/research\/video\/challenges-in-malware-analysis\/","title":{"rendered":"Challenges in Malware Analysis"},"content":{"rendered":"<div class=\"asset-content\">\n<p>Program analysis is a challenging task when source code is available. It is even more challenging when analyzing malware where neither the source code nor debug information are present.<br \/>\nMalware authors often employ a myriad of evasion techniques to impede automated reverse engineering and static analysis efforts of their binaries.  This makes it challenging to uncover the malware intent and the full spectrum of embedded capabilities. In this presentation, we review the main challenges when analyzing binary programs and explore techniques for recovery of information that allows program understanding and reverse-engineering.  In particular, we describe a set of techniques for automatically unrolling the impact of code obfuscators with the objective of completely recovering the original malware logic. We will describe obfuscation strategies employed by infamous malware instances such as Conficker C, Hydraq (the binary associated with the Google attack), and Stuxnet.<\/p>\n<\/div>\n<p><!-- .asset-content --><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Program analysis is a challenging task when source code is available. It is even more challenging when analyzing malware where neither the source code nor debug information are present. Malware authors often employ a myriad of evasion techniques to impede automated reverse engineering and static analysis efforts of their binaries. This makes it challenging to [&hellip;]<\/p>\n","protected":false},"featured_media":197084,"template":"","meta":{"msr-url-field":"","msr-podcast-episode":"","msrModifiedDate":"","msrModifiedDateEnabled":false,"ep_exclude_from_search":false,"footnotes":""},"research-area":[],"msr-video-type":[206954],"msr-locale":[268875],"msr-impact-theme":[],"msr-pillar":[],"class_list":["post-188259","msr-video","type-msr-video","status-publish","has-post-thumbnail","hentry","msr-video-type-microsoft-research-talks","msr-locale-en_us"],"msr_download_urls":"","msr_external_url":"https:\/\/youtu.be\/An8gyBs61Zo","msr_secondary_video_url":"","msr_video_file":"","_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-video\/188259"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-video"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/types\/msr-video"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-video\/188259\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/media\/197084"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/media?parent=188259"}],"wp:term":[{"taxonomy":"msr-research-area","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/research-area?post=188259"},{"taxonomy":"msr-video-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-video-type?post=188259"},{"taxonomy":"msr-locale","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-locale?post=188259"},{"taxonomy":"msr-impact-theme","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-impact-theme?post=188259"},{"taxonomy":"msr-pillar","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-pillar?post=188259"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}