System and method for detecting multi-component malware

A system for detecting malicious program behavior, the system comprising:

• a system memory;
• and
• a processor operably coupled to the system memory and configured to
• emulate in the system memory at least a part of a computer program;
• detect events being generated by one or more executable components of the emulated computer program;
• determine, substantially in real time, whether one or more detected events are associated with a malicious program behavior;
• store in a data structure in the system memory only detected events associated with the malicious program behavior;
• and
• compare events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors to detect malicious program behavior of the emulated computer program.

A computer-readable medium comprising computer-executable instructions for detecting malicious program behavior, the computer-executable instructions include:

• instructions for emulating at least a part of a computer program in an isolated computing environment,
• instructions for detecting events being generated by one or more executable components of the emulated computer program;
• instructions for determining, substantially in real time, whether one or more detected events are associated with a malicious program behavior;
• instructions for storing in a data structure only detected events associated with the malicious program behavior;
• and
• instructions for comparing events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors to detect malicious program behavior of the emulated computer program.