Systems and methods for identifying malware

A system for identifying malware, the system comprising:

• a determination module, stored in memory, that determines, for multiple commands within bytecode associated with a malware program, whether each command constitutes an invocation command;
• a filtration module, stored in memory, that filters, based on the determination, invocation commands from the bytecode;
• an addition module, stored in memory, that adds, for each invocation command filtered from the bytecode, a concatenation comprising an opcode, a format code, and a function prototype to a collection of concatenations comprising opcodes, format codes, and function prototypes;
• a generation module, stored in memory, that generates at least two digital fingerprints based on the collection of the concatenations comprising the opcode, the format code, and the function prototype for each invocation command filtered from the bytecode, the at least two digital fingerprints comprising at least two of:
• a digital fingerprint of the collection after executing an ordering algorithm on the collection;
• a digital fingerprint of the collection without executing the ordering algorithm;
• a digital fingerprint of a prefix of the collection;
• and
• a digital fingerprint of a suffix of the collection;
• a performance module, stored in memory, that performs a remedial action to protect a user in response to detecting the presence of a variant of the malware program by determining that a candidate instance of bytecode under evaluation matches at least one of the at least two generated digital fingerprints;
• and
• at least one physical processor configured to execute the determination module, the filtration module, the addition module, the generation module, and the performance module.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• determine, for multiple commands within bytecode associated with a malware program, whether each command constitutes an invocation command;
• filter, based on the determination, invocation commands from the bytecode;
• add, for each invocation command filtered from the bytecode, a concatenation comprising an opcode, a format code, and a function prototype to a collection of concatenations comprising opcodes, format codes, and function prototypes;
• generate at least two digital fingerprints based on the collection of the concatenations comprising the opcode, the format code, and the function prototype for each invocation command filtered from the bytecode, the at least two digital fingerprints comprising at least two of:
• a digital fingerprint of the collection after executing an ordering algorithm on the collection;
• a digital fingerprint of the collection without executing the ordering algorithm;
• a digital fingerprint of a prefix of the collection;
• and
• a digital fingerprint of a suffix of the collection;
• and
• perform, by a computer security system, a remedial action to protect a user in response to detecting the presence of a variant of the malware program by determining that a candidate instance of bytecode under evaluation matches at least one of the at least two generated digital fingerprints.