Ao Kaspersky Lab

Other

Kaspersky Lab, Zao

Andrey V Krukov

Anton M Ivanov

Vyacheslav V Zakorzhevsky

Evgeny A Aseev

Alexander V Liskin

Vyacheslav V Zakorzhevski

A method and system is provided for detecting malicious compound files. An example method includes: obtaining at least one compound file; identifying a first set of features of the at least one compound file including features associated with a header of the at least one compound file; subsequent to identifying the first set of features, identifying, by the processor, a second set of features of the at least one compound file including features associated with at least one directory of the at least one compound file; determining a hash sum of the at least one compound file based on the first and second set of features; comparing the hash sum of the at least one compound file with information associated with a plurality of compound files stored in a database; and identifying the at least one compound file as being malicious, trusted or untrusted based at least on comparison results.

System and method for detecting malicious compound files

Disclosed are systems, methods and computer program products for detection of harmful files of different formats. An example method includes: receiving a suspicious file; determining a file format of the suspicious file; determining, using antivirus software, if the suspicious file is clean or harmful; and when the antivirus software fails to determine whether the suspicious file is clean or harmful, selecting, based on at least the file format of the suspicious file, a configuration of a virtual machine for analyzing a maliciousness of the suspicious file by at least: selecting a program associated with the file format of the suspicious file, opening the suspicious file using the associated program in the virtual machine, collecting data of at least one activity on the virtual machine, and analyzing the data to determine the maliciousness of the suspicious file.

System and methods for detecting harmful files of different formats in virtual environments

Disclosed are systems, methods and computer program products for detection of harmful files of different formats. An example method includes determining a suspicious file and a file format of the suspicious file; analyzing the suspicious file by an antivirus software to determine whether the suspicious file is clean or harmful; when the suspicious file is determined to be harmful by the antivirus software, generating a signature of the suspicious file and updating a collection of harmful files with the signature of the suspicious file; and when the suspicious file is not determined to be clean or harmful by the antivirus software, selecting, based on at least the file format of the suspicious file, a configuration of a virtual machine for analysis of the suspicious file, and analyzing the suspicious file by the virtual machine with selected configuration to determine whether the suspicious file is clean or harmful.

System and methods for detecting harmful files of different formats

Growing community of inventors

Moscow, Russia

Andrey V Krukov