Layout scanner for application classification

A non-transitory computer-readable storage device with instructions stored thereon for implementing a method of classifying software that, when executed by one or more computer processors, cause the one or more computer processors to perform operations comprising:

• receiving an executable file within a computer, wherein it is unknown whether said executable file is malware;
• executing said executable file within a virtualization environment of said computer and creating a process identifier for said executing file;
• identifying a graphical user interface program of said executable file during said execution by comparing said process identifier of said executing executable file with process identifiers of graphical user interface programs that are executing within said virtualization environment, said graphical user interface program including a plurality of windows;
• obtaining position and dimension values for each of said windows from said graphical user interface program via a function;
• querying a database with said position and dimension values of said executable file to determine whether said position and dimension values are present within said database, wherein said database comprises sets of position and dimension values, each of said sets including a label indicating a type of an executable file corresponding to said each of said sets;
• determining whether a certain number of said position and dimension values of each of said windows match a set of position and dimension values within said database, wherein a match occurs if the position and dimension values of a window of each of said windows do not vary by more than a certain percentage from the set of position and dimension values within said database;
• and
• returning, by the computing device, a result regarding a classification of said executable file based upon said querying of said database, said result indicating whether said classification of said executable file is malware.