Evaluating installers and installer payloads

A computer program product comprising non-transitory computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:

• receiving, on an endpoint, an installer containing one or more packed computer objects;
• determining a reputation of the installer;
• unpacking each of the packed computer objects to provide one or more unpacked computer objects, wherein unpacking includes creating a signature for each of the packed computer objects before unpacking;
• associating the reputation of the installer with each of the one or more unpacked computer objects such that the reputation of the installer is inherited as a first reputation of each of the one or more unpacked computer objects;
• in a secure environment, analyzing each of the unpacked computer objects to evaluate compliance with a security policy and provide a second reputation, wherein analyzing each of the unpacked computer objects includes looking up information using the signature for one or more of the packed computer objects;
• for each of the one or more unpacked computer objects, reconciling the first reputation and the second reputation to a reconciled reputation, the reconciled reputation based on weighting each of the first reputation and the second reputation according to confidence in the respective reputation;
• providing a determination regarding whether to permit or deny execution of each of the one or more unpacked computer objects on a device based on the reconciled reputation;
• and
• based on the determination, permitting or denying execution of each of the one or more unpacked computer objects on the device.

A system for evaluating computer objects supplied in an installer for unpacking and execution on a computing device, the system comprising:

• a processor;
• and
• a non-transitory computer-readable medium comprising computer executable instructions, the computer executable instructions when executing on the processor performs operations comprising
• receiving, on the computing device, an installer containing one or more packed computer objects;
• determining a reputation of the installer;
• unpacking each of the packed computer objects to provide one or more unpacked computer objects, wherein unpacking includes creating a signature for each of the packed computer objects before unpacking;
• associating the reputation of the installer with each of the one or more unpacked computer objects such that the reputation of the installer is inherited as a first reputation of each of the one or more unpacked computer objects;
• in a secure environment, determining a second reputation of the one or more unpacked computer objects, wherein determining the second reputation of the one or more unpacked computer objects includes looking up information using the signature for one or more of the packed computer objects;
• and
• for each of the one or more unpacked computer objects, reconciling the first reputation and the second reputation to a reconciled reputation, the reconciled reputation based on weighting each of the first reputation and the second reputation according to confidence in the respective reputation;
• providing a determination regarding whether to permit or deny execution of each of the one or more unpacked computer objects on the computing device based on the reconciled reputation;
• and
• based on the determination, permitting or denying execution of each of the one or more unpacked computer objects on the computing device.