Title:
APPARATUS AND METHOD FOR CHECKING NON-EXECUTABLE FILES
Document Type and Number:
WIPO Patent Application WO/2013/168913
Kind Code:
A1
Abstract:
The present invention relates to an apparatus and a method for checking non-executable files. The apparatus includes: a data loading unit that loads malicious candidate address information related to a malicious code of a non-executable file; a program connection unit that obtains normal address range information for a module, which is stored in a memory, and sets a breakpoint for the malicious candidate address information; a maliciousness determining unit that determines whether a next execution address belongs to the normal address range information when an event for the breakpoint occurs. Accordingly, the present invention has the effect of quickly and accurately detecting a malicious non-executable file before a malicious code in the non-executable file is executed.
Inventors:
LIM CHA SUNG (KR)
LEE JU SEOK (KR)
LEE JU SEOK (KR)
Application Number:
PCT/KR2013/003427
Publication Date:
November 14, 2013
Filing Date:
April 23, 2013
Export Citation:
Assignee:
AHNLAB INC (KR)
International Classes:
G06F21/00; G06F11/28
Foreign References:
| KR100516304B1 | 2005-09-26 | |||
| KR100992434B1 | 2010-11-05 | |||
| KR20080043201A | 2008-05-16 | |||
| KR100945247B1 | 2010-03-03 |
Attorney, Agent or Firm:
FIRSTLAW P.C. (KR)
제일특허법인 (KR)
제일특허법인 (KR)
Download PDF: