Malware detection based on user interactions

A method, comprising:

• receiving, by a device, a file that has been downloaded to a first user device or that is to be downloaded to the first user device;
• processing, by the device, the file to determine one or more file identification properties;
• obtaining, by the device and based on the one or more file identification properties, metadata identifying user interactions associated with the file that include at least one of:
• a first group of user interactions that were performed when the file was accessed on the first user device, or
• a second group of user interactions that were performed when the file was accessed on one or more other user devices;
• performing, by the device and within a sandbox environment, the user interactions identified by the metadata;
• executing, by the device and within the sandbox environment, a malware detection procedure to determine whether the file is malware,
• wherein the user interactions are performed to reduce or eliminate a likelihood of a malware defense mechanism triggering benign malware behavior prior to execution of the malware detection procedure;
• and
• providing, by the device and to the first user device, a notification indicating whether the file is malware to cause the first user device to perform one or more actions when the file is malware.

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors of a user device, cause the one or more processors to:
• receive a file that is to be accessed on the user device;
• process the file to determine a file identifier;
• capture user interactions with one or more interface objects, associated with the file, that are displayed after the file is accessed;
• generate metadata identifying the user interactions with the one or more interface objects associated with the file;
• provide the file identifier and the metadata to a data structure accessible by a security platform to permit the security platform to test the file in a sandbox environment to determine whether the file is malware;
• receive, from the security platform, a notification indicating whether the file is malware;
• and
• perform one or more actions to undo a set of modifications to the user device that were caused by the malware based on receiving the notification and the notification indicating that the file is malware.