An API deobfuscation method combining dynamic and static techniques
Qi Xi, Tianyang Zhou, Qingxian Wang, Yongjun Zeng · 2013
API calls analysis is usually used for malicious behavior detection, but malware authors adopt encryption techniques to hide API information where calling them dynamically. Consequently, the decryption of internal ciphertext data in malware is now critical for malware analysis. In this paper, we proposed a novel approach to automatically resolve the encryption strings from malware. By analyzing the inherent dependencies between functions, we automatically identified decryption routine and extracted its context. To reveal the encryption API names, the proposed approach loads the malware and constructs context of decryption routine, and then forces the program calling decryption routines. The feasibility of our approach is demonstrated by implementing a prototype framework called ADSD(API Deobfuscation based on Static and Dynamic techniques).