Systems and methods for establishing a reputation for related program files

A system for establishing a reputation for related program files, the system comprising:

• a file identification module, stored in memory, that identifies a set of related program files, wherein:
• each program file includes at least one common metadata field value that comprises a globally unique program module version identifier that is common to multiple variants of a malware program file, the at least one common metadata field value comprising a module version ID according to the MICROSOFT.NET development platform;
• and
• the value of the metadata field is set by a program development tool;
• a malware module, stored in memory, that identifies at least one of the set of related program files as malicious;
• an analysis module, stored in memory, that determines that a proportion of malicious files in the set of related program files is above a threshold;
• a reputation module, stored in memory, that, in response to determining that the proportion of malicious files is above the threshold, associates a negative reputation with the globally unique program module version identifier that is common to the multiple variants of the malware program file;
• and
• at least one physical processor configured to execute the file identification module, the malware module, the analysis module, and the reputation module as part of an anti-malware program to protect a user from malware.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify a set of related program files, wherein:
• each program file includes at least one common metadata field value that comprises a globally unique program module version identifier that is common to multiple variants of a malware program file, the at least one common metadata field value comprising a module version ID according to the MICROSOFT.NET development platform;
• and
• the value of the metadata field is set by a program development tool;
• identify at least one of the set of related program files as malicious;
• determine that a proportion of malicious files in the set of related program files is above a threshold;
• and
• in response to determining that the proportion of malicious files is above the threshold, associate a negative reputation with the globally unique program module version identifier that is common to the multiple variants of the malware program file;
• wherein the computer-readable instructions form at least part of an anti-malware program that, when executed, protects a user from malware.