# US 12,008,103 B2 · Method and apparatus for detecting malware via analysis of a screen capture > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,103 B2 - Document ID: US12008103B2 - Status: Granted - Kind: B2 - Application number: 17/970,404 - Filed: 2022-10-20 - Published: 2023-02-09 - Granted: 2024-06-11 - Earliest claimed: 2020-09-11 - Assignees: Mcaffe, LLC - Applicants: McAfee, LLC - Inventors: Hardik Shah - Web page: https://patentgrep.com/patent/US12008103B2 ## CPC - G06F 21/564: {by virus signature recognition} - G06F 11/327: {Alarm or error message display} - G06F 21/54: by adding security routines or objects to programs - G06F 21/554: {involving event detection and direct action} - G06F 21/565: {by checking file integrity} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods, apparatus, systems and articles of manufacture for detecting malware via analysis of a screen capture are disclosed. An example apparatus includes at least one memory, instructions, and processor circuitry to execute the instructions. The processor circuitry is to detect execution of a process, capture a portion of a screen buffer as a captured image, after the execution of the process is detected, analyze the captured image to determine an image similarity to a stored image in a database, the database to at least store malicious images, and perform a responsive action when the image similarity satisfies a similarity threshold. ## Claims ### Claim 1 An apparatus comprising: at least one memory; instructions; and processor circuitry to execute the instructions to: determine whether an identifier of a detected process is included in a list of processes capable of executing a macro; capture, after the execution of the process is detected and the determination that the identifier of the process is included in the list of processes, a portion of a screen buffer as a captured image; analyze the captured image to determine an image similarity to a stored image in a database, the database to at least store images of malicious user interfaces; perform a responsive action to prevent a user from enabling the macro when the image similarity satisfies a first similarity threshold; perform character recognition to identify text in the captured image when the image similarity does not satisfy the first similarity threshold; analyze the identified text to determine a text similarity to text in the database, the database to at least store text corresponding to a malicious macro; and perform the responsive action when the text similarity satisfies a second similarity threshold. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the processor circuitry is to: obtain an indication of a malicious process activity, the malicious process activity associated with at least a portion of the captured image; and cause the captured image to be stored in the database after obtaining the indication of the malicious process activity. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the processor circuitry is to analyze the captured image by obtaining the stored image from a local cache. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the local cache is to be synchronized with a central repository of known malicious images. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the processor circuitry is further to: obtain an indication of a malicious process activity, the malicious process activity associated with at least a portion of the captured image; and cause the text identified in the captured image to be stored in the database after obtaining the indication of the malicious process activity. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein to perform the responsive action, the processor circuitry is further to at least one of: display an error message to the user; or transmit an alert to a central monitoring facility. ### Claim 7 At least one non-transitory computer readable medium comprising instructions that, when executed, cause at least one processor to at least: determine whether an identifier of a detected process is included in a list of processes capable of executing a macro; capture, after the execution of the process is detected and the determination that the identifier of the process is included in the list of processes, a portion of a screen buffer as a captured image; analyze the captured image to determine an image similarity to a stored image in a database, the database to at least store images of malicious user interfaces; perform a responsive action to prevent a user from enabling the macro when the image similarity satisfies a first similarity threshold; perform character recognition to identify text in the captured image when the image similarity does not satisfy the first similarity threshold; analyze the text identified in the captured image to determine a text similarity to stored text in the database, the database to at least store text corresponding to a malicious macro; and perform the responsive action when the text similarity satisfies a second similarity threshold. ### Claim 8 (depends on 7) The at least one non-transitory computer readable medium of claim 7, wherein the instructions, when executed, cause the at least one processor to: obtain an indication of a malicious process activity, the malicious process activity associated with at least a portion of the captured image; and cause the captured image to be stored in the database after obtaining the indication of the malicious process activity. ### Claim 9 (depends on 7) The at least one non-transitory computer readable medium of claim 7, wherein the instructions, when executed, cause the at least one processor to: analyze the captured image by obtaining the stored image from a local cache. ### Claim 10 (depends on 9) The at least one non-transitory computer readable medium of claim 9, wherein the instructions, when executed, cause the at least one processor to: synchronize the local cache with a central repository of known malicious images. ### Claim 11 (depends on 7) The at least one non-transitory computer readable medium of claim 7, wherein the instructions, when executed, cause the at least one processor to: obtain an indication of a malicious process activity, the malicious process activity associated with at least a portion of the captured image; and cause the text identified in the captured image to be stored in the database after obtaining the indication of the malicious process activity. ### Claim 12 (depends on 7) The at least one non-transitory computer readable medium of claim 7, wherein the responsive action further includes the instructions, when executed, to cause the at least one processor to at least one of: display an error message to the user; or transmit an alert to a central monitoring facility. ### Claim 13 A method comprising: detecting, by executing an instruction with at least one processor, execution of a process; determining, by executing an instruction with the at least one processor, whether an identifier of the process is included in a list of processes capable of executing a macro; capturing, by executing an instruction with the at least one processor after the execution of the process is detected and the determination that the identifier of the process is included in the list of processes, a portion of a screen buffer as a captured image; analyzing, by executing an instruction with the at least one processor, the captured image to determine an image similarity to a stored image in a database, the database to at least store images of malicious user interfaces; performing, by executing an instruction with the at least one processor, a responsive action to prevent a user from enabling the macro when the image similarity satisfies a first similarity threshold; performing character recognition to identify text in the captured image when the image similarity does not satisfy the first similarity threshold; analyzing the text identified in the captured image to determine a text similarity to stored text in the database, the database to at least store text corresponding to a malicious macro; and performing the responsive action when the text similarity satisfies a second similarity threshold. ### Claim 14 (depends on 13) The method of claim 13, further including: obtaining an indication of a malicious process activity, the malicious process activity associated with at least a portion of the captured image; and causing the captured image to be stored in the database after obtaining the indication of the malicious process activity. ### Claim 15 (depends on 13) The method of claim 13, further including analyzing the captured image by obtaining the stored image from a local cache. ### Claim 16 (depends on 15) The method of claim 15, further including synchronizing the local cache with a central repository of known malicious images. ### Claim 17 (depends on 13) The method of claim 13, further including: obtaining an indication of a malicious process activity, the malicious process activity associated with at least a portion of the captured image; and causing the text identified in the captured image to be stored in the database after obtaining the indication of the malicious process activity.