Methods for identifying malicious software

A method for identifying malicious software in an executable file, comprising:

• dividing a portion of the executable file into a plurality of windows, each window of the plurality of windows comprising one or more bytes;
• applying to the one or more bytes of the plurality of windows a transformation function that provides a numerically comparable value for the each window;
• and
• displaying graphically the numerically comparable value for the each window as a function of the each window.

A method for identifying malicious software in an executable file, comprising:

• disassembling a portion of the executable file into instructions;
• dividing the portion into a plurality of windows, each window of the plurality of windows comprising one or more instructions;
• applying to the one or more instructions of the plurality of windows a transformation function that provides a numerically comparable value for the each window and results in a list of numerically comparable values for the plurality of windows;
• determining if a value from the list is a statistical outlier with respect to other values from the list;
• and
• if the value is a statistical outlier, identifying a window comprising the value as the malicious software.

A method for identifying decryption code in an executable file, comprising:

• disassembling a portion of the executable file into a series of instructions;
• searching the series for a reversible instruction;
• analyzing a first group of instructions that immediately follow the reversible instruction for a jump instruction that sends control to a jump location in a second group of instructions that immediately precede the reversible instruction;
• locating an instruction that writes to random access memory in the series between the jump location and the jump instruction;
• and
• identifying a group of instructions in the series between the jump location and the jump instruction as decryption code.

A method for identifying a cryptographic function in an executable file, comprising:

• obtaining a known cryptographic function implementation comprising one or more numeric constants;
• performing a string comparison of the one or more numeric constants with the executable file;
• and
• identifying the portion of the executable file matching of the one or more numeric constants as the cryptographic function.