Systems and methods for detecting malware using static analysis

Abstract

The disclosed computer-implemented method for detecting malware using static analysis may include (i) identifying an executable file to subject to analysis for malware, (ii) retrieving an association between a known malicious behavior and an exploitable method being invoked, wherein the association specifies that a contextual method precedes the exploitable method in an invocation path and that the exploitable method is invoked with a set of predetermined parameters, (iii) detecting, within the executable file, an invocation of the exploitable method, (iv) determining that the invocation of the exploitable method within the executable file occurs in a detected invocation path in which the contextual method precedes the exploitable method and that the invocation of the exploitable method includes a set of invoking parameters that matches the set of predetermined parameters, and (v) classifying the executable file as containing malware. Various other methods, systems, and computer-readable media are also disclosed.