System and method for detecting suspicious actions of a software object

1. A system for detecting malicious software, comprising:

at least one hardware processor adapted to:

execute a tested software object in a plurality of computing environments each configured according to a different hardware and software configuration;

monitor a plurality of computer actions performed in each of the plurality of computing environments when executing the tested software object;

identify at least one difference between the plurality of computer actions performed in a first of the plurality of computing environments and the plurality of computer actions performed in a second of the plurality of computing environments; and

instruct a presentation of an indication of the identified at least one difference on a hardware presentation unit;

wherein the first of the plurality of computing environments comprises configuring a first operating system with a first date and time of day;

wherein the second of the plurality of computing environments comprises configuring a second operating system with a second date and time of day; and

wherein the first date and time of day is different from the second date and time of day;

wherein the first computing environment of the plurality of computing environments comprises executing at least one software program selected from a plurality of identified software programs;

wherein the at least one software program is not executed in the second computing environment of the plurality of computing environments;

wherein instructing the presentation comprises sending a message indicative of the identified at least one difference to an identified hardware device.

2. The system of claim 1 , wherein the first computing environment of the plurality of computing environments comprises executing a first identified operating system;

wherein the second computing environment of the plurality of computing environments comprises executing a second identified operating system; and

wherein the first identified operating system is different from the second identified operating system.

3. The system of claim 1 , wherein at least one of the plurality of computing environments comprises executing the tested software object by a virtual machine executed by at least one of the at least one hardware processor.

4. The system of claim 1 , wherein the first computing environment of the plurality of computing environments comprises executing a first version of an identified operating system;

wherein the second computing environment of the plurality of computing environments comprises executing a second version of the identified operating system; and

wherein the first version of the identified operating system is different from the second version of the operating system.

5. The system of claim 1 , further comprising a digital data networking device;

wherein in the first computing environment of the plurality of computing environments at least one of the at least one hardware processor is connected to the digital data networking device; and

wherein in the second computing environment of the plurality of computing environments the at least one hardware processor is not connected to the digital data networking device.

6. The system of claim 5 , wherein the digital data networking device is connected to a local area digital data network.

7. The system of claim 5 , wherein the digital data networking device is connected to a public digital data network.

8. The system of claim 7 , wherein the public digital data network is the Internet.

9. The system of claim 3 , wherein the first computing environment of the plurality of computing environments comprises executing the tested software object by a virtual machine executed by at least one of the at least one hardware processor; and

wherein the second computing environment of the plurality of computing environments does not comprise a virtual machine executed by the at least one hardware processor.

10. The system of claim 1 , wherein the plurality of computer actions comprises at least one action selected from a group of actions consisting of: sending a message on a digital data network, receiving a message via a digital data network, reading a digital memory, modifying a content of a digital memory, reading from a digital storage, writing to a digital storage, erasing from a digital storage, instructing activation of a software program, instructing termination of a software program, instructing activation of a software process, instructing termination of a software process, instructing a system restart, sending a message to an executed software program using an inter process communication method as known in the art, instructing an operating system operation via an application programming interface command, performing a computation utilizing a central processor unit (CPU) more than an identified threshold CPU-utilization value, and delivering digital data or a signal to a hardware device connected to the at least one hardware processor.

11. The system of claim 10 , wherein the hardware device is a visual display device or an audio device.

12. The system of claim 10 , wherein the identified difference comprises one or more differences selected from a group of differences consisting of: a difference in data included in the message sent on the digital network, and a difference in data included in the message received on the digital network.

13. The system of claim 1 , wherein the plurality of computer actions performed in the first of the plurality of computing environments comprises at least one identified computer action;

and the plurality of computer actions performed in the second of the plurality of computing environments does not comprise the at least one identified computer action.

14. The system of claim 1 , wherein the hardware presentation unit is a visual display device.

15. The system of claim 1 , wherein the identified hardware device is a computer, a mobile phone or a mobile computerized device.

16. A method for detecting malicious software, comprising:

executing on at least one hardware processor a tested software object in a plurality of computing environments each configured according to a different hardware and software configuration;

monitoring a plurality of computer actions performed in each of the plurality of computing environments when executing the tested software object;

identifying at least one difference between the plurality of computer actions performed in a first of the plurality of computing environments and the plurality of computer actions performed in a second of the plurality of computing environments; and

instructing a presentation of an indication of the identified at least one difference on a hardware presentation unit;

wherein the first of the plurality of computing environments comprises configuring a first operating system with a first date and time of day;

wherein the second of the plurality of computing environments comprises configuring a second operating system with a second date and time of day; and

wherein the first date and time of day is different from the second date and time of day;

wherein the first computing environment of the plurality of computing environments comprises executing at least one software program selected from a plurality of identified software programs; wherein the at least one software program is not executed in the second computing environment of the plurality of computing environments;

wherein instructing the presentation comprises sending a message indicative of the identified at least one difference to an identified hardware device.