Detecting a harmful file using a database of vulnerable drivers

A system for detecting a harmful file, the system comprising:

• a memory and a hardware processor configured to:
• detect an activity of a driver operating in a user mode in an operating system by intercepting an Application Programming Interface (API) request from the driver operating in the user mode to an application using another driver operating in kernel mode;
• analyze the detected activity of the driver operating in the user mode to determine if the driver operating in the user mode is dangerous or harmless, wherein analyzing the detected activity of the driver operating in the user mode comprises determining a danger coefficient of the driver by assigning weighted values to a plurality of observed driver activities;
• search for a file that is linked to the application and that uses the driver operating in the user mode, in response to determining that the driver operating in the user mode is dangerous based on the danger coefficient of the driver exceeding a threshold value;
• check the file found by the search for harmfulness, wherein checking the file for harmfulness comprises assigning a higher danger coefficient to the file if it is used by a dangerous driver, as compared to a file that is used by a secure driver;
• and
• declare the file found by the search as harmful based at least on the danger coefficient assigned to the file.

A non-transitory computer readable medium storing thereon computer executable instructions for detecting a harmful file, including instructions for:

• detecting an activity of a driver operating in a user mode in an operating system by intercepting an Application Programming Interface (API) request from the driver operating in the user mode to an application using another driver operating in kernel mode;
• analyzing the detected activity of the driver operating in the user mode to determine if the driver operating in the user mode is dangerous or harmless, wherein analyzing the detected activity of the driver operating in the user mode comprises determining a danger coefficient of the driver by assigning weighted values to a plurality of observed driver activities;
• searching for a file that is linked to the application and that uses the driver operating in the user mode, in response to determining that the driver operating in the user mode is dangerous based on the danger coefficient of the driver exceeding a threshold value;
• checking the file found by the search for harmfulness, wherein checking the file for harmfulness comprises assigning a higher danger coefficient to the file if it is used by a dangerous driver, as compared to a file that is used by a secure driver;
• and
• declaring the file found by the search as harmful based at least on the danger coefficient assigned to the file.