Acer Cyber Security Incorporated

Tzu-Ching Chang

Chiung-Ying Huang

Ming-Kung Sun

Tung-Lin Tsai

Gu-Hsin Lai

Chia-Mei Chen

An electronic device and a method for detecting a malicious file are provided. The method includes the following steps: An executable file is searched, and an import table is extracted from the executable file. The import table includes at least a name of a first DDL and a name of a second DDL. A distance between the first DLL and the second DLL is calculated. Whether the distance exceeds a threshold is determined. If the distance exceeds the threshold, then whether a duplicate content of the import table exists in the executable file is checked. The executable file is regarded as a malicious file if the duplicate content of the import table exists in the executable file.

Growing community of inventors

Taipei, Taiwan

Tzu-Ching Chang