System and method of identifying a malicious intermediate language file

A system for detecting malicious intermediate language files comprising:

• a database comprising hashes of known malicious intermediate language files;
• a resource allocation module executing on a hardware processor, the resource allocation module configured to select a set of resources from a file being analyzed, wherein the file is an intermediate language file;
• a hash calculation module, coupled to the resource allocation module, configured to calculate a perceptive hash of the set of resources;
• and
• an analysis module, coupled to the other modules, configured to:
• identify a degree of similarly between the set of resources and a set of resources from known malicious files by comparing the perceptive hash with perceptive hashes of the set of resources from known malicious files;
• determine a harmfulness of the file being analyzed based on the degree of similarity;
• and
• remove or quarantine the file being analyzed when the harmfulness exceeds a predetermined threshold.

A non-transitory computer-readable medium storing thereon executable instructions that when executed by a hardware processor perform a method for detecting malicious intermediate language files comprising:

• selecting a set of resources from a file being analyzed, wherein the file is an intermediate language file;
• calculating a perceptive hash of a the set of resources;
• identifying a degree of similarly between the set of resources and a set of resources from known malicious files by comparing the perceptive hash with perceptive hashes of the set of resources from known malicious files;
• determining a harmfulness of the file being analyzed based on the degree of similarity;
• and
• removing or quarantining the file being analyzed when the harmfulness exceeds a predetermined threshold.