Systems and methods for identifying malicious files

Abstract

The disclosed computer-implemented method for identifying malicious files may include (1) identifying different instances of a file that is subject to a security evaluation, (2) identifying, within a field for each of the different instances, an attribute of the different instance that associates the different instance with a respective application, (3) determining that the respective applications to which the different instances of the file are associated are distinct applications and are known to be safe, (4) adjusting a security policy for the file, by increasing an estimation that the file is malicious, based on the determination that the respective applications are distinct applications and are known to be safe, and (5) classifying, in a software security system, the file as malicious based on the adjusted security policy that increased the estimation that the file is malicious. Various other methods, systems, and computer-readable media are also disclosed.