Systems and methods for evaluating unfamiliar executables

1. A computer-implemented method for evaluating unfamiliar executables, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying, on the computing device:

a code object that is generated from source code written in a programming language, that is specified in an intermediate language different from the programming language, and that can be compiled into an executable file by a just-in-time compiler on the computing device; and

an executable file that lacks an assigned reputation in a reputation system that distinguishes benign and malicious files;

associating the executable file with the code object based on determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device; and

in response to associating the executable file with the code object:

retrieving, from the reputation system, a reputation for the code object; and

performing a security action on the executable file that is based on the reputation of the code object rather than the assigned reputation of the executable file due to the executable file lacking the assigned reputation in the reputation system.

2. The computer-implemented method of claim 1 , wherein performing the security action comprises allowing the executable file to execute based on determining, based on the reputation of the code object, the code object is benign.

3. The computer-implemented method of claim 1 , wherein performing the security action comprises preventing the executable file from executing based on determining, based on the reputation of the code object, that the code object is malicious.

4. The computer-implemented method of claim 1 , further comprising:

identifying an additional executable file that has an additional assigned reputation in the reputation system; and

performing an additional security action on the additional executable file based on the additional assigned reputation of the additional executable file in the reputation system.

5. The computer-implemented method of claim 1 , wherein:

identifying the executable file comprises determining that the executable file is a singleton that has not been previously identified on any computing system connected to the reputation system; and

performing the security action on the executable file that is based on the reputation of the code object rather than the assigned reputation of the executable file due to the executable file is in response to determining that the executable file is the singleton.

6. The computer-implemented method of claim 1 , wherein:

identifying the executable file comprises quarantining the executable file; and

performing the security action on the executable file comprises removing the executable file from quarantine.

7. The computer-implemented method of claim 1 , further comprising:

identifying an additional executable file that was produced by an additional code object;

monitoring behavior of the additional executable file; and

assigning a reputation to the additional code object in the reputation system based on the behavior of the additional executable file.

8. The computer-implemented method of claim 1 , wherein determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device comprises:

configuring the just-in-time compiler to store output to a specified file system layer; and

monitoring the specified file system layer to which the just-in-time compiler stores the output.

9. The computer-implemented method of claim 1 , wherein determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device comprises hooking the just-in-time compiler.

10. The computer-implemented method of claim 1 , wherein determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device comprises determining that just-in-time compiler produced the executable file within a predetermined time of the just-in-time compiler reading the code object.

11. The computer-implemented method of claim 1 , wherein the intermediate language comprises bytecode.

12. A system for evaluating unfamiliar executables, the system comprising:

an identification module, stored in memory, that identifies, on a computing device:

a code object that is generated from source code written in a programming language, that is specified in an intermediate language different from the programming language, and that can be compiled into an executable file by a just-in-time compiler on the computing device; and

an executable file that lacks an assigned reputation in a reputation system that distinguishes benign and malicious files;

a determination module, stored in memory, that associates the executable file with the code object based on determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device;

a retrieving module, stored in memory, that retrieves, from the reputation system and in response to associating the executable file with the code object, a reputation for the code object;

a security module, stored in memory, that performs a security action on the executable file that is based on the reputation of the code object rather than the assigned reputation of the executable file due to the executable file lacking the assigned reputation in the reputation system; and

at least one physical processor configured to execute the identification module, the determination module, the retrieving module, and the security module.

13. The system of claim 12 , wherein the security module performs the security action by allowing the executable file to execute based on determining, based on the reputation of the code object, the code object is benign.

14. The system of claim 12 , wherein the security module performs the security action by preventing the executable file from executing based on determining, based on the reputation of the code object, that the code object is malicious.

15. The system of claim 12 , wherein:

the identification module further identifies an additional executable file that has an additional assigned reputation in the reputation system; and

the security module further performs an additional security action on the additional executable file based on the additional assigned reputation of the additional executable file in the reputation system.

16. The system of claim 12 , wherein:

the identification module identifies the executable file by determining that the executable file is a singleton that has not been previously identified on any computing system connected to the reputation system; and

the security module performs the security action on the executable file that is based on the reputation of the code object rather than the assigned reputation of the executable file due to the executable file in response to determining that the executable file is the singleton.

17. The system of claim 12 , wherein:

the identification module quarantines the executable file; and

the security module performs the security action on the executable file by removing the executable file from quarantine.

18. The system of claim 12 , wherein the identification module further:

identifies an additional executable file that was produced by an additional code object;

monitors behavior of the additional executable file; and

assigns a reputation to the additional code object in the reputation system based on the behavior of the additional executable file.

19. The system of claim 12 , wherein the determination module determines that the executable file was produced by the just-in-time compiler compiling the code object on the computing device by:

configuring the just-in-time compiler to store output to a specified file system layer; and

monitoring the specified file system layer to which the just-in-time compiler stores the output.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify, on the computing device:

a code object that is generated from source code written in a programming language, that is specified in an intermediate language different from the programming language, and that can be compiled into an executable file by a just-in-time compiler on the computing device; and

an executable file that lacks an assigned reputation in a reputation system that distinguishes benign and malicious files;

associate the executable file with the code object based on determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device; and

in response to associating the executable file with the code object:

retrieve, from the reputation system, a reputation for the code object; and

perform a security action on the executable file that is based on the reputation of the code object rather than the assigned reputation of the executable file due to the executable file lacking the assigned reputation in the reputation system.