# US 2025/0094589 A1 · Detecting microsoft windows installer malware using text classification models > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0094589 A1 - Document ID: US20250094589A1 - Status: Published application - Kind: A1 - Application number: 18/968,872 - Filed: 2024-12-04 - Published: 2025-03-20 - Earliest claimed: 2021-12-14 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Akshata Krishnamoorthy Rao; Yaron Samuel; Lauren Che; Wenjun Hu - Web page: https://patentgrep.com/patent/US20250094589A1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/54: by adding security routines or objects to programs - G06F 21/554: {involving event detection and direct action} - G06F 21/564: {by virus signature recognition} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present application discloses a method, system, and computer system for detecting malicious files. The method includes receiving a sample, extracting an embedded script from the sample, applying a malicious script detector in connection with determining whether the sample is malicious, and in response to determining that the sample is malicious sending, to a security entity, an indication that the sample is malicious. ## Claims ### Claim 1 A system, comprising: one or more processors configured to: receive a sample wherein the sample is a Microsoft Windows Portable Executable (PE) file; extract an embedded script from the sample; determine a PE file structure for the file; detect a malicious sample based at least in part on the installer script and a PE file structure for the sample; and in response to determining that the sample is malicious, cause an active measure to be performed; and a memory coupled to the one or more processors and configured to provide the one or more processors with instructions. ### Claim 2 (depends on 1) The system of claim 1, wherein detecting the malicious sample comprises: is using a classifier to determine a maliciousness classification for the sample based at least in part on the installer script and a PE file structure for the sample. ### Claim 3 (depends on 2) The system of claim 2, wherein using the classifier to determine the maliciousness classification for the sample comprises: determining one or more features based at least in part on one or more of the installer script and the PE file structure for the sample; and querying the classifier based at least in part on the one or more features. ### Claim 4 (depends on 2) The system of claim 2, wherein the classifier is a machine learning model. ### Claim 5 (depends on 2) The system of claim 2, wherein using the classifier to determine the maliciousness classification for the sample comprises: analyzing code corresponding to the embedded script to determine whether the code comprises one or more elements that are indicative of malicious code. ### Claim 6 (depends on 5) The system of claim 5, wherein analyzing code corresponding to the embedded script to determine whether the code comprises one or more elements that are indicative of malicious code comprises: applying a text classification machine learning model prediction in connection with detecting, in the code, the one or more elements that are indicative of malicious code. ### Claim 7 (depends on 1) The system of claim 1, wherein causing the active measure to be performed comprises: causing a policy to be enforced at a security entity. ### Claim 8 (depends on 7) The system of claim 7, wherein the policy is configured based at least in part on a customer setting. ### Claim 9 (depends on 7) The system of claim 7, wherein the security entity blocks traffic comprising the sample in response to receiving the indication that the sample is malicious. ### Claim 10 (depends on 7) The system of claim 7, wherein the security entity is a firewall. ### Claim 11 (depends on 1) The system of claim 1, wherein the active measure comprises one or more of (a) blocking transmission of the sample, (b) quarantining the sample, and (c) deleting the sample. ### Claim 12 (depends on 1) The system of claim 1, wherein the active measure includes: determining a signature for the sample; and updating a blacklist to include the signature for the sample. ### Claim 13 (depends on 1) The system of claim 1, wherein extracting the embedded script comprises: extracting the installer script from the sample; and decompiling the installer script to obtain code corresponding to the installer script. ### Claim 14 (depends on 1) The system of claim 1, wherein: detect the malicious sample based at least in part on the installer script and the PE file structure for the sample comprises: determining a likelihood that code corresponding to the embedded script is malicious; and the sample is deemed to be malicious in response to a determination that the likelihood that the code corresponding to the embedded script is malicious is greater than a likelihood threshold value. ### Claim 15 (depends on 11) The system of claim 11, wherein the likelihood that the code corresponding to the embedded script is malicious is determined based at least in part on a degree of similarity between the code and one or more other malicious code samples. ### Claim 16 (depends on 1) The system of claim 1, wherein causing the active measure to be performed comprises sending a signature or file hash corresponding to the sample to a security entity in connection with sending the indication that the sample is malicious. ### Claim 17 (depends on 1) The system of claim 1, wherein one or more factors used in connection with detecting that the sample corresponds to a malicious sample comprises determining that code corresponding to the embedded script is malicious comprises: a call to an executable file or to a cryptocurrency wallet. ### Claim 18 (depends on 1) The system of claim 1, wherein the sample is determined to be malicious based at least in part on one or more of (i) an executable called in the extracted installer script, (ii) a cryptocurrency wallet called in the extracted installer script, and (iii) an alphanumeric string comprised in the extracted installer script. ### Claim 19 A method, comprising: receiving, by one or more processors, a sample, wherein the sample is a Microsoft Windows Portable Executable (PE) file; extracting an embedded script from the sample, wherein the embedded script is an installer script; determining a PE file structure for the file; detecting a malicious sample based at least in part on the installer script and a PE file structure for the sample; and in response to determining that the sample is malicious, causing an active measure to be performed. ### Claim 20 A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: receiving, by one or more processors, a sample, wherein the sample is a Microsoft Windows Portable Executable (PE) file; extracting an embedded script from the sample, wherein the embedded script is an installer script; determining a PE file structure for the file; detecting a malicious sample based at least in part on the installer script and a PE file structure for the sample; and in response to determining that the sample is malicious, causing an active measure to be performed.