- Title
- A sandbox-based approach to the deobfuscation and dissection of php-based malware
- Creator
- Wrench, Peter M
- Creator
- Irwin, Barry V W
- Date Issued
- 2015
- Date
- 2015
- Type
- text
- Type
- article
- Identifier
- http://hdl.handle.net/10962/429258
- Identifier
- vital:72571
- Identifier
- 10.23919/SAIEE.2015.8531886
- Description
- The creation and proliferation of PHP-based Remote Access Trojans (or web shells) used in both the compromise and post exploitation of web platforms has fuelled research into automated methods of dissecting and analysing these shells. Current malware tools disguise themselves by making use of obfuscation techniques designed to frustrate any efforts to dissect or reverse engineer the code. Advanced code engineering can even cause malware to behave differently if it detects that it is not running on the system for which it was originally targeted. To combat these defensive techniques, this paper presents a sandbox-based environment that aims to accurately mimic a vulnerable host and is capable of semi-automatic semantic dissection and syntactic deobfuscation of PHP code.
- Format
- 18 pages
- Format
- Language
- English
- Relation
- Saiee Africa Research Journal
- Relation
- Wrench, P. and Irwin, B., 2015. A sandbox-based approach to the deobfuscation and dissection of php-based malware. Saiee Africa Research Journal, 106(2), pp.46-63
- Relation
- Saiee Africa Research Journal volume 106 number 2 46 63 2015 1991-1696
- Rights
- Publisher
- Rights
- Use of this resource is governed by the terms and conditions of the IEEE Xplore Terms of Use Statement (https://ieeexplore.ieee.org/Xplorehelp/overview-of-ieee-xplore/terms-of-use)
- Hits: 46
- Visitors: 46
- Downloads: 4
Thumbnail | File | Description | Size | Format | |||
---|---|---|---|---|---|---|---|
View Details Download | SOURCE1 | A sandbox-based approach to the deobfuscation and dissection of php-based malware.pdf | 675 KB | Adobe Acrobat PDF | View Details Download |