File scanner to detect malicious electronic files
View Patent ↗Disclosed herein are embodiments of systems, methods, and products for detecting malicious electronic files. Detecting malicious electronic files can include intercepting files configured to be transmitted from a first computer to a second computer and extracting a first set of code scattered in a first electronic file of the two or more electronic files. Detecting malicious electronic files can include extracting a second set of code scattered in a second electronic file of the two or more electronic files, deobfuscating the first and second sets of code by removing command string concatenations and decoding encoded strings, and examining the first and second deobfuscated sets of code by applying malicious behavior rules against the first and second deobfuscated sets of code while restricting the first and second sets of code being executed on the second computer or the server.
1 . A method, comprising:
intercepting, by a server, two or more electronic files configured to be transmitted from a first computer to a second computer;
extracting, by the server, a first set of code scattered in a first electronic file of the two or more electronic files;
identifying, by the server, an object interface embedded within or linked to the first electronic file;
extracting, by the server, a second electronic file corresponding to the object interface;
extracting, by the server, a second set of code scattered in the second electronic file of the two or more electronic files;
deobfuscating, by the server, the first and second sets of code by removing command string concatenations and decoding encoded strings;
examining, by the server, the first and second deobfuscated sets of code by applying malicious behavior rules against the first and second deobfuscated sets of code while restricting the first and second sets of code being executed on the second computer or the server; and
upon determining the first and second deobfuscated sets of code containing contents that match the malicious behavior rules, transmitting, by the server, the one or more electronic files to a malware repository.
2 . The method of claim 1 , further comprising:
generating, by the server, alert notifications indicating the first and second electronic files are potentially malicious; and
transmitting, by the server, the alert notifications to a computing device associated with an analyst.
3 . The method of claim 2 , wherein the alert notifications comprise alert identifiers, the potentially malicious electronic files, file paths of the potentially malicious electronic files, a deobfuscated set of code containing contents that match the malicious behavior rules, the malicious behavior rules applied to the first and second electronic files, and hierarchical relationships between the electronic files.
4 . The method of claim 2 , wherein the alert notifications are transmitted as email, instant message, text message, voicemail, or any other electronic messages.
5 . The method of claim 1 , further comprising:
determining, by the server, a risk level for the first and second electronic files; and
transmitting, by the server, alert notifications of the first and second electronic files based on the risk level.
6 . The method of claim 1 , further comprising:
storing, by the server, the first and second electronic files into a malware repository off network for further investigation.
7 . The method of claim 1 , further comprising:
updating, by the server, a malicious behavior database storing the malicious behavior rules with new malicious behavior rules based on new knowledge of malicious attacks.
8 . The method of claim 1 , further comprising:
identifying and recording, by the server, a hierarchical relationship between the second electronic file and the first electronic file.
9 . The method of claim 1 , further comprising:
extracting, by the server, objects and code from the first and second electronic files; and
storing, by the server, the extracted objects and code into separate folders.
10 . The method of claim 1 , wherein the malicious behavior rules comprise rules defining Boolean statements, regular expressions, and statistical measures for malicious software detection.
11 . A non-transitory computer-readable medium comprising instructions that, when executed, cause operations comprising:
intercepting, by a server, two or more electronic files configured to be transmitted from a first computer to a second computer;
extracting, by the server, a first set of code scattered in a first electronic file of the two or more electronic files;
identifying, by the server, an object interface embedded within or linked to the first electronic file;
extracting, by the server, a second electronic file corresponding to the object interface;
extracting, by the server, a second set of code scattered in the second electronic file of the two or more electronic files;
deobfuscating, by the server, the first and second sets of code by removing command string concatenations and decoding encoded strings;
examining, by the server, the first and second deobfuscated sets of code by applying malicious behavior rules against the first and second deobfuscated sets of code while restricting the first and second sets of code being executed on the second computer or the server; and
upon determining the first and second deobfuscated sets of code containing contents that match the malicious behavior rules, transmitting, by the server, the one or more electronic files to a malware repository.
12 . The non-transitory computer-readable medium of claim 11 , the operations comprising:
generating, by the server, alert notifications indicating the first and second electronic files are potentially malicious; and
transmitting, by the server, the alert notifications to a computing device associated with an analyst.
13 . The non-transitory computer-readable medium of claim 12 , wherein the alert notifications comprise alert identifiers, the potentially malicious electronic files, file paths of the potentially malicious electronic files, a deobfuscated set of code containing contents that match the malicious behavior rules, the malicious behavior rules applied to the first and second electronic files, and hierarchical relationships between the electronic files.
14 . The non-transitory computer-readable medium of claim 12 , wherein the alert notifications are transmitted as email, instant message, text message, voicemail, or any other electronic messages.
15 . The non-transitory computer-readable medium of claim 11 , the operations comprising:
determining, by the server, a risk level for the first and second electronic files; and
transmitting, by the server, alert notifications of the first and second electronic files based on the risk level.
16 . The non-transitory computer-readable medium of claim 11 , the operations comprising:
storing, by the server, the first and second electronic files into a malware repository off network for further investigation.
17 . The non-transitory computer-readable medium of claim 11 , the operations comprising:
updating, by the server, a malicious behavior database storing the malicious behavior rules with new malicious behavior rules based on new knowledge of malicious attacks.
18 . The non-transitory computer-readable medium of claim 11 , the operations comprising:
identifying and recording, by the server, a hierarchical relationship between the second electronic file and the first electronic file.
19 . The non-transitory computer-readable medium of claim 11 , the operations comprising:
extracting, by the server, objects and code from the first and second electronic files; and
storing, by the server, the extracted objects and code into separate folders.
20 . The non-transitory computer-readable medium of claim 11 , wherein the malicious behavior rules comprise rules defining Boolean statements, regular expressions, and statistical measures for malicious software detection.