These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Sandboxes and other dynamic analysis processes are prevalent in malware
detection systems nowadays to enhance the capability of detecting 0-day
malware. Therefore, techniques of anti-dynamic analysis (TADA) are prevalent in
modern malware samples, and sandboxes can suffer from false negatives and
analysis failures when analyzing the samples with TADAs. In such cases, human
reverse engineers will get involved in conducting dynamic analysis manually
(i.e., debugging, patching), which in turn also gets obstructed by TADAs. In
this work, we propose a Large Language Model (LLM) based workflow that can
pinpoint the location of the TADA implementation in the code, to help reverse
engineers place breakpoints used in debugging. Our evaluation shows that we
successfully identified the locations of 87.80% known TADA implementations
adopted from public repositories. In addition, we successfully pinpoint the
locations of TADAs in 4 well-known malware samples that are documented in
online malware analysis blogs.