Granted Patent B1

US 9,246,933 · App. 13/557,679 · Granted Jan 26, 2016

Abstract

Claims (71)

1. A computer-implemented method for detecting malicious email attachments, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying a shortcut file received as an attachment to an email, wherein the shortcut file is configured to open a target file;

analyzing the shortcut file by parsing one or more sections of the shortcut file to identify a command line argument that applies to the target file, wherein the command line argument comprises information about the target file useful for determining whether text accurately characterizes the shortcut file;

identifying accompanying text in the email that characterizes the attachment;

determining that the attachment is malicious by:

comparing the command line argument that applies to the target file with the accompanying text in the email that characterizes the attachment;

based on the comparison, determining that the accompanying text does not accurately characterize the shortcut file.

2. The method of claim 1 , wherein:

the shortcut file comprises a LNK file;

identifying the command line argument comprises identifying the command line argument from a STRING DATA section of the LNK file.

3. The method of claim 2 , further comprising determining, based on the comparison, that the command line argument applying to the target file is malicious, wherein the command line argument comprises at least one of:

a malicious instruction;

malicious content;

a malicious payload;

a malicious application.

4. The method of claim 3 , wherein the malicious payload comprises malicious instructions delivered via the target file and/or an application configured to open the target file.

5. The method of claim 1 , wherein:

identifying the command line argument comprises determining that the command line argument is attempting to execute a computer application that retrieves a file via the Internet;

identifying the accompanying text in the email comprises determining that the accompanying text indicates that the shortcut file is a text document;

determining that the accompanying text does not accurately characterize the shortcut file comprises determining that the accompanying text indicates that the shortcut file is a text document.

6. The method of claim 1 , further comprising performing a security action responsive to determining that the attachment is malicious, wherein the security action comprises at least one of:

displaying a warning message indicating that the attachment is malicious;

describing an anticipated effect of opening the attachment;

blocking an attempt to open the attachment;

quarantining the attachment;

removing the attachment.

7. The method of claim 1 , wherein:

the target file and the shortcut file are separate files;

selecting the shortcut file produces the same result as selecting the target file.

8. The method of claim 1 , wherein the shortcut file comprises at least one of a LNK file extension or a URL file extension.

9. The method of claim 1 , wherein identifying the accompanying text in the email comprises parsing the accompanying text to identify at least one key word that characterizes the attachment.

10. The method claim 1 , wherein identifying the accompanying text in the email comprises:

comparing at least one word and/or phrase in the email to a text database;

determining a meaning of the word and/or phrase based on a definition according to the text database.

11. A system for detecting malicious email attachments, the system comprising:

a shortcut-identification module programmed to identify a shortcut file received as an attachment to an email, wherein the shortcut file is configured to open a target file;

an attribute-identification module programmed to analyze the shortcut file by parsing one or more sections of the shortcut file to identify a command line argument that applies to the target file, wherein the command line argument comprises information about the target file useful to determine whether text accurately characterizes the shortcut file;

a text-identification module programmed to identify accompanying text in the email that characterizes the attachment;

a malicious-attachment-determination module programmed to determine that the attachment is malicious by:

comparing the command line argument that applies to the target file with the accompanying text in the email that characterizes the attachment;

based on the comparison, determining that the accompanying text does not accurately characterize the shortcut file;

at least one hardware processor configured to execute the shortcut-identification module, the attribute-identification module, the text-identification module, and the malicious-attachment-determination module.

12. The system of claim 11 , wherein:

the shortcut file comprises a LNK file;

the attribute-identification module is programmed to identify the command line argument by identifying the command line argument from a STRING DATA section of the LNK file.

13. The system of claim 12 , wherein the malicious-attachment-determination module is further programmed to determine, based on the comparison, that the command line argument applying to the target file is malicious, wherein the command line argument comprises at least one of:

a malicious instruction;

malicious content;

a malicious payload;

a malicious application.

14. The system of claim 13 , wherein the malicious payload comprises malicious instructions delivered via the target file and/or an application configured to open the target file.

15. The system of claim 11 , wherein:

the attribute-identification module is further programmed to determine that the command line argument is attempting to execute a computer application that retrieves a file via the Internet;

the text-identification module is further programmed to determine that the accompanying text indicates that the shortcut file is a text document;

the malicious-attachment-determination module is programmed to determine that the accompanying text does not accurately characterize the shortcut file based on the determination that the accompanying text indicates that the shortcut file is a text document.

16. The system of claim 11 , wherein the malicious-attachment-determination module is further configured to perform a security action responsive to determining that the attachment is malicious, wherein the security action comprises at least one of:

displaying a warning message indicating that the attachment is malicious;

describing an anticipated effect of opening the attachment;

blocking an attempt to open the attachment;

quarantining the attachment;

removing the attachment.

17. The system of claim 11 , wherein:

the target file and the shortcut file are separate files;

selecting the shortcut file produces the same result as selecting the target file.

18. The system of claim 11 , wherein the shortcut file comprises at least one of a LNK file extension or a URL file extension.

19. A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify a shortcut file received as an attachment to an email, wherein the shortcut file is configured to open a target file;

analyze the shortcut file by parsing one or more sections of the shortcut file to identify a command line argument that applies to the target file, wherein the command line argument comprises information about the target file useful to determine whether text accurately characterizes the shortcut file;

identify accompanying text in the email that characterizes the attachment;

determine that the attachment is malicious by comparing the command line argument that applies to the target file with the accompanying text in the email that characterizes the attachment and, based on the comparison, determining that the accompanying text does not accurately characterize the shortcut file.

20. The non-transitory computer-readable-storage medium of claim 19 , wherein the shortcut file comprises at least one of a LNK file extension or a URL file extension.

Assignments (6)