Detecting malware concealed by delay loops of software programs

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors, cause the one or more processors to:
• receive a software program with potential malware and a loop to conceal the potential malware;
• identify the loop in the software program with a loop identification technique;
• modify, with a loop exit technique and based on data from the loop identification technique, the software program to exit the loop;
• process the software program, with a malware detection technique and after modifying the software program to exit the loop, to determine whether the software program contains malware;
• determine that the software program contains malware based on processing the software program with the malware detection technique;
• and
• cause one or more actions to be performed based on determining that the software program contains malware.

A method, comprising:

• receiving, by a device, a software program with potential malware and a loop to conceal the potential malware;
• processing, by the device, the software program, with a loop identification technique, to identify the loop in the software program;
• modifying, by the device, the software program to exit the loop using a loop exit technique and based on data from the loop identification technique;
• processing, by the device and after modifying the software program to exit the loop, the software program with a malware detection technique to determine whether the software program contains malware;
• and
• selectively performing, by the device, an action based on a result of processing the software program with the malware detection technique,
• the action including a first action when the software program contains malware, and
• the action including a second action when the software program does not contain malware.