Systems and methods for detecting suspicious applications based on how entry-point functions are triggered

A system for detecting suspicious applications based on how entry-point functions are triggered, the system comprising:

• an application-identifying module, stored in memory, that identifies an application that is capable of accessing:
• a data-access Application Programming Interface (API) programmed to provide access to sensitive information located on a computing device;
• and
• a data-transfer API programmed to send information outside of the computing device;
• a function-identifying module, stored in memory, that identifies, as part of statically analyzing the application before the application is executed, an entry-point function that acts as a point of entry into the application whose execution results in a call to at least one of:
• the data-access API;
• and
• the data-transfer API;
• a trigger-determining module, stored in memory, that determines, as part of statically analyzing the application before the application is executed, that the entry-point function is a type of function that is not triggered in response to a user's interaction with the application;
• a suspicion-determining module, stored in memory, that determines, as part of statically analyzing the application before the application is executed, that the application is suspicious based at least in part on a determination that the entry-point function is the type of function that is not triggered in response to a user's interaction with the application;
• a security module, stored in memory, that performs a security action in response to a determination that the application is suspicious;
• and
• at least one hardware processor that executes the application-identifying module, the function-identifying module, the trigger-determining module, the suspicion-determining module, and the security module.

A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify an application that is capable of accessing:
• a data-access Application Programming Interface (API) programmed to provide access to sensitive information located on a computing system;
• and
• a data-transfer API programmed to send information outside of the computing system;
• identify, as part of statically analyzing the application before the application is executed, an entry-point function that acts as a point of entry into the application whose execution results in a call to at least one of:
• the data-access API;
• and
• the data-transfer API;
• determine, as part of statically analyzing the application before the application is executed, that the entry-point function is a type of function that is not triggered in response to a user's interaction with the application;
• determine, as part of statically analyzing the application before the application is executed based at least in part on determining that the entry-point function is the type of function that is not triggered in response to a user's interaction with the application that the application is suspicious;
• and
• perform, in response to determining that the application is suspicious, a security action.