Systems and methods for detecting and protecting against malicious software

1. A computer-implemented method for detecting and protecting against malicious software, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

loading an untrusted application into an emulated computing environment, the untrusted application having a defined entry point;

executing a first instance of the untrusted application in the emulated computing environment beginning at the defined entry point;

identifying, by analyzing a plurality of additional entry points of the untrusted application, an additional entry point that is likely to trigger a payload;

prioritizing the additional entry point over other additional entry points for execution as a second entry point;

executing a second instance of the untrusted application beginning at the second entry point that is downstream from the defined entry point so as to bypass at least a portion of the untrusted application executed in the first instance;

identifying the untrusted application as a threat based on information extracted from the second instance of the untrusted application; and

performing a security action to protect against the untrusted application identified as a threat.

2. The computer-implemented method of claim 1 , further comprising:

analyzing the untrusted application for heuristic hints to identify the second entry point.

3. The computer-implemented method of claim 2 , wherein the heuristic hints comprise at least one of string concatenations, strings composed from hexadecimal codes, abnormal code constructs, and variable name entropy.

4. The computer-implemented method of claim 1 , further comprising:

prioritizing one of the other additional entry points for execution as a third entry point;

executing a third instance of the untrusted application at the third entry point downstream from the defined entry point and upstream of the second entry point, wherein, based on priority, the third instance is executed at the third entry point subsequent to execution of the second instance at the second entry point.

5. The computer-implemented method of claim 1 , wherein the first instance of the untrusted application terminates prior to running a payload and the second instance of the untrusted application runs the payload.

6. The computer-implemented method of claim 1 , wherein identifying the untrusted application as a threat comprises at least one of identifying suspicious behavior of the untrusted application, identifying unpacking of malicious code, identifying the generation of autorun files, and identifying attempts to alter system files.

7. The computer-implemented method of claim 1 , wherein the untrusted application is a script comprising statements, wherein the second entry point comprises the beginning of a statement.

8. The computer-implemented method of claim 1 , wherein the second entry point comprises an application programming interface import location in a portable executable.

9. A system for detecting malicious software, the system comprising:

at least one physical processor;

physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the at least one physical processor to:

load an untrusted application into an emulated computing environment, the untrusted application having a defined entry point;

execute a first instance of the untrusted application in the emulated computing environment beginning at the defined entry point;

identify, by analyzing a plurality of additional entry points of the untrusted application, an additional entry point that is likely to trigger a payload;

prioritize the additional entry point over other additional entry points for execution as a second entry point;

execute a second instance of the untrusted application beginning at the second entry point that is downstream from the defined entry point so as to bypass at least a portion of the untrusted application executed in the first instance; and

identify the untrusted application as a threat based on information extracted from the second instance of the untrusted application.

10. The system of claim 9 , wherein the computer executable instructions further cause the at least one physical processor to analyze the untrusted application for heuristic hints to determine the second entry point.

11. The system of claim 10 , wherein the heuristic hints comprise at least one of string concatenations, strings composed from hexadecimal codes, abnormal code constructs, and variable name entropy.

12. The system of claim 9 , wherein the computer executable instructions further cause the at least one physical processor to load a script comprising statements, wherein a statement is used as the second entry point to the script.

13. The system of claim 9 , wherein the computer executable instructions further cause the at least one physical processor to load a portable executable beginning at a second entry point comprising an application programming interface import location.

14. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

load an untrusted application into an emulated computing environment, the untrusted application having a defined entry point;

execute a first instance of the untrusted application in the emulated computing environment beginning at the defined entry point;

identify, by analyzing a plurality of additional entry points of the untrusted application, an additional entry point that is likely to trigger a payload;

prioritize the additional entry point over other additional entry points for execution as a second entry point;

execute a second instance of the untrusted application beginning at the second entry point downstream from the defined entry points as to bypass at least a portion of the untrusted application executed in the first instance; and

identify the untrusted application as a threat based on information extracted from the second instance of the untrusted application.

15. The non-transitory computer-readable medium of claim 14 , wherein the computer-executable instructions further cause the computing device to:

analyze the untrusted application for heuristic hints to determine the second entry point.

16. The non-transitory computer-readable medium of claim 15 , wherein the heuristic hints are selected from the group consisting of string concatenations, strings composed from hexadecimal codes, abnormal code constructs, and variable name entropy.

17. The non-transitory computer-readable medium of claim 14 , wherein the computer-executable instructions further cause the computing device to:

execute a third instance of the untrusted application at a third entry point downstream from the defined entry point and the second entry point.

18. The non-transitory computer-readable medium of claim 14 , wherein the first instance of the untrusted application terminates prior to running a payload and the second instance of the untrusted application runs the payload.

19. The non-transitory computer-readable medium of claim 14 , wherein the untrusted application is a script comprising statements, wherein a statement is used as the second entry point.

20. The non-transitory computer-readable medium of claim 14 , wherein the second entry point comprises an application programming interface import location in a portable executable.