Systems and methods for detecting malicious documents based on component-object reuse

A system for detecting malicious documents based on component-object reuse, the system comprising:

• an identifying module, stored in memory, that:
• identifies a plurality of malicious digital documents that contain malware;
• extracts a plurality of benign digital component objects from the plurality of malicious digital documents, wherein each benign digital component object from the plurality of benign digital component objects is:
• contained within at least one malicious digital document from the plurality of malicious digital documents;
• not known to contain malware;
• a receiving module, stored in memory, that receives, from a digital-document source device, an unknown digital document that is not known to be malicious or benign and that comprises:
• at least one benign digital component object that is benign;
• at least one malicious digital component object that is malicious;
• a determining module, stored in memory, that:
• extracts the benign digital component object from the unknown digital document;
• determines that the benign digital component object extracted from the unknown digital document matches one of the plurality of benign digital component objects;
• determines, based at least in part on the benign digital component object extracted from the unknown digital document matching one of the plurality of benign digital component objects, that an attacker likely reused the benign digital component object extracted from the unknown digital document to create the unknown digital document;
• a security module, stored in memory, that disarms, in response to determining that an attacker likely reused the benign digital component object extracted from the unknown digital document to create the unknown digital document, the malicious digital component object of the unknown digital document by performing a security action on the unknown digital document;
• at least one physical processor that executes the identifying module, the receiving module, the determining module, and the security module.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify a plurality of malicious digital documents that contain malware;
• extract a plurality of benign digital component objects from the plurality of malicious digital documents, wherein each benign digital component object from the plurality of benign digital component objects is:
• contained within at least one malicious digital document from the plurality of malicious digital documents;
• not known to contain malware;
• receive, from a digital-document source device, an unknown digital document that is not known to be malicious or benign and that comprises:
• at least one benign digital component object that is benign;
• at least one malicious digital component object that is malicious;
• extract the benign digital component object from the unknown digital document;
• determine that the benign digital component object extracted from the unknown digital document matches one of the plurality of benign digital component objects;
• determine, based at least in part on the benign digital component object extracted from the unknown digital document matching one of the plurality of benign digital component objects, that an attacker likely reused the benign digital component object extracted from the unknown digital document to create the unknown digital document;
• disarm, in response to determining that an attacker likely reused the benign digital component object extracted from the unknown digital document to create the unknown digital document, the malicious digital component object of the unknown digital document by performing a security action on the unknown digital document.