Static Detection Method for Obfuscated API-calling Behavior
Cheng Wang · Jisuanji gongcheng · 2010
To extract API-calling behaviors from malware and their variants effectively,this paper proposes an approach to statically detect the obfuscated API-calling behaviors in Windows platform.In this approach,instruction pattern matching is used to recognize the special calling manner.The relationship between the targets of call instructions and the name strings of API functions is analyzed to identify which API function is called actually.Experimental results show that using this approach can improve detection ability of static analysis tools through static analysis.