Detecting microsoft windows installer malware using text classification models
AssigneePalo Alto Networks, Inc.
InventorsAkshata Krishnamoorthy Rao, Yaron Samuel, Lauren Che, Wenjun Hu
Life of this patent
Estimating the term…
Abstract
The present application discloses a method, system, and computer system for detecting malicious files. The method includes receiving a sample, extracting an embedded script from the sample, applying a malicious script detector in connection with determining whether the sample is malicious, and in response to determining that the sample is malicious sending, to a security entity, an indication that the sample is malicious.
Claims20
A system, comprising:
- one or more processors configured to:
- receive a sample wherein the sample is a Microsoft Windows Portable Executable (PE) file;
- extract an embedded script from the sample;
- determine a PE file structure for the file;
- detect a malicious sample based at least in part on the installer script and a PE file structure for the sample;
- and
- in response to determining that the sample is malicious, cause an active measure to be performed;
- and
- a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.
A method, comprising:
- receiving, by one or more processors, a sample, wherein the sample is a Microsoft Windows Portable Executable (PE) file;
- extracting an embedded script from the sample, wherein the embedded script is an installer script;
- determining a PE file structure for the file;
- detecting a malicious sample based at least in part on the installer script and a PE file structure for the sample;
- and
- in response to determining that the sample is malicious, causing an active measure to be performed.
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- receiving, by one or more processors, a sample, wherein the sample is a Microsoft Windows Portable Executable (PE) file;
- extracting an embedded script from the sample, wherein the embedded script is an installer script;
- determining a PE file structure for the file;
- detecting a malicious sample based at least in part on the installer script and a PE file structure for the sample;
- and
- in response to determining that the sample is malicious, causing an active measure to be performed.
Dependencies are inferred from the claim text.