Malware identification via secondary file analysis

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors, cause the one or more processors to:
• receive a file that is to be analyzed for malware;
• open the received file in a first secure environment;
• install a secondary file in the first secure environment to permit a malicious object of the received file to embed a malicious payload of the received file in the secondary file,
• the secondary file being a file within a directory of a computing environment that runs an application or program that opens the received file;
• determine that the secondary file in the first secure environment has been accessed after opening, by a user, the received file;
• open the secondary file in a second secure environment to identify malware;
• and
• perform an action associated with the received file based on identifying the malware,
• where the first secure environment is implemented on a computing resource of a cloud environment, and
• where the one or more instructions, that cause the one or more processors to perform the action associated with the received file, cause the one or more processors to:
• quarantine a source of the received file based on identifying the malware.

A method, comprising:

• receiving, by one or more devices of a security platform, a file that into be analyzed for malware;
• opening, by at least one of the one or more devices, the received file in a secure environment;
• installing, by at least one of the one or more devices, a secondary file in the secure environment to permit a malicious object of the received file to embed a malicious payload of the received file in the secondary file,
• the secondary file being a file within a directory of a computing environment that runs an application or program that opens the received file;
• determining, by at least one of the one or more devices, that the secondary file in the secure environment has been modified based on the received file being opened by a user;
• opening, by at least one of the one or more devices, the secondary file in the secure environment;
• identifying, by at least one of the one or more devices, malware after opening the secondary file;
• and
• performing, by at least one of the one or more devices, an action associated with the received file based on identifying the malware,
• where the secure environment is implemented on a computing resource of a cloud environment, and
• where performing the action comprises:
• quarantining a source of the received file based on identifying the malware.