System for identifying suspicious code embedded in a file in an isolated computing environment

1. A system for identifying suspicious code embedded in a file in an isolated computing environment, the system comprising:

one or more memory devices storing computer-readable code; and

one or more processing devices operatively coupled to the one or more memory devices, wherein the one or more processing devices are configured to execute the computer-readable code to:

automatically receive an indication of suspicious information from a target user computer system associated with a target user that received the suspicious information from an external system;

automatically transfer the suspicious information to a virtual container upon the receipt of the indication of the suspicious information, wherein the virtual container operates within an isolation system that comprises a plurality of virtual containers comprising the virtual container that provides physical separation and logical separation when analyzing the suspicious information, wherein virtual environment configurations for the virtual container are automatically set based on configurations of the target user computer system from which the suspicious information was received;

execute the suspicious information within the virtual container in response to the transfer of the suspicious information to the virtual container;

identify at least a signature or a pattern associated with the suspicious information, wherein the signature or the pattern is associated with one or more moves implemented by the suspicious information upon the execution of the suspicious information in the virtual container;

compare a hash of the signature or the pattern with stored hashes of signatures or patterns;

determine that the suspicious information comprises harmful information when the hash matches the stored hashes of signatures or patterns; and

perform a mitigation action based on the determination that the suspicious information comprises the harmful information.

2. The system of claim 1 , wherein the one or more processing devices are further configured to execute the computer-readable code to:

determine that the hash does not match the stored hashes of signatures or patterns;

allow an analyst user to access to at least one other virtual container in order to further analyze the suspicious information when the hash does not match the stored hashes of signatures or patterns; and

allow the analyst user to analyze the suspicious information in the at least one other virtual container.

3. The system of claim 2 , wherein the one or more processing devices are further configured to execute the computer-readable code to:

receive an indication from the analyst user that the suspicious information does not comprise the harmful information; and

determine that the suspicious information is acceptable information.

4. The system of claim 1 , wherein the one or more processing devices are further configured to execute the computer-readable code to:

store the hash in an acceptable list comprising a plurality of acceptable signature hashes.

5. The system of claim 1 , wherein the mitigation action comprises discarding the virtual container.

6. The system of claim 1 , wherein the indication of the suspicious information is received automatically from an organization system.

7. The system of claim 1 , wherein the isolation system is accessed through an application programming interface located on an analyst computer system, on the isolation system, or on an application programing interface system.

8. The system of claim 1 , wherein the one or more processing devices are further configured to execute the computer-readable code to:

create the plurality of virtual containers for a plurality of analysts, wherein each of the plurality of virtual containers are specific to each of the plurality of analysts.

9. The system of claim 1 , wherein the one or more processing devices are further configured to execute the computer-readable code to:

create the virtual container when an analyst user accesses the system.

10. The system of claim 9 , wherein the one or more processing devices are further configured to execute the computer-readable code to:

receive the virtual environment configurations from the analyst user for the virtual container for the suspicious information.

11. The system of claim 1 , wherein the mitigation action comprises sending a notification to a user when the harmful information is identified.

12. The system of claim 1 , wherein the mitigation action comprises requesting removal of the harmful information from the target user computer system, allowing an analyst user to access target user computer system of the target user to remediate the harmful information, requiring a username or password change, notifying other analyst users of the harmful information, notifying other users within an organization of the harmful information, notifying a third-party of the harmful information, blocking a website for the harmful information, preventing future download of the harmful information, or automatically deleting any future communication with the harmful information.

13. The system of claim 1 , wherein the one or more processing devices are configured to execute the computer-readable code to:

store a log of each analysis action performed by an analyst user within the virtual container while analyzing the suspicious information.

14. A method for identifying suspicious code embedded in a file in an isolated computing environment, the method comprising:

automatically receiving an indication of suspicious information from a target user computer system associated with a target user that received the suspicious information from an external system;

automatically transferring the suspicious information to a virtual container upon the receipt of the indication of the suspicious information, wherein the virtual container operates within an isolation system that comprises a plurality of virtual containers comprising the virtual container that provides physical separation and logical separation when analyzing the suspicious information, wherein virtual environment configurations for the virtual container are automatically set based on configurations of the target user computer system from which the suspicious information was received;

executing the suspicious information within the virtual container in response to the transfer of the suspicious information to the virtual container;

identifying at least a signature or a pattern associated with the suspicious information, wherein the signature or the pattern is associated with one or more moves implemented by the suspicious information upon the execution of the suspicious information in the virtual container;

comparing a hash of the signature or the pattern with stored hashes of signatures or patterns;

determining that the suspicious information comprises harmful information when the hash matches the stored hashes of signatures or patterns; and

performing a mitigation action based on the determination that the suspicious information comprises the harmful information.

15. The method of claim 14 , further comprising:

determining that the hash does not match the stored hashes of signatures or patterns;

allowing an analyst user to access to at least one other virtual container in order to further analyze the suspicious information when the hash does not match the stored hashes of signatures or patterns; and

allowing the analyst user to analyze the suspicious information in the at least one other virtual container.

16. A computer program product for identifying suspicious code embedded in a file in an isolated computing environment, the computer program product comprising at least one non-transitory computer-readable medium having computer-readable program code portions embodied therein, the computer-readable program code portions, when executed by a processor, cause the processor to perform operations comprising:

automatically receiving an indication of suspicious information from a target user computer system associated with a target user that received the suspicious information from an external system;

automatically transferring the suspicious information to a virtual container upon the receipt of the indication of the suspicious information, wherein the virtual container operates within an isolation system that comprises a plurality of virtual containers comprising the virtual container that provides physical separation and logical separation when analyzing the suspicious information, wherein virtual environment configurations for the virtual container are automatically set based on configurations of the target user computer system from which the suspicious information was received;

executing the suspicious information within the virtual container in response to the transfer of the suspicious information to the virtual container;

identifying at least a signature or a pattern associated with the suspicious information, wherein the signature or the pattern is associated with one or more moves implemented by the suspicious information upon the execution of the suspicious information in the virtual container;

comparing a hash of the signature or the pattern with stored hashes of signatures or patterns;

determining that the suspicious information comprises harmful information when the hash matches the stored hashes of signatures or patterns; and

performing a mitigation action based on determining that the suspicious information comprises the harmful information.

17. The computer program product of claim 16 , wherein the computer-readable program code portions, when executed by the processor, cause the processor to further perform operations comprising:

determining that the hash does not match the stored hashes of signatures or patterns;

allowing an analyst user to access to at least one other virtual container in order to further analyze the suspicious information when the hash does not match the stored hashes of signatures or patterns; and

allowing the analyst user to analyze the suspicious information in the at least one other virtual container.

18. The computer program product of claim 17 , wherein the computer-readable program code portions, when executed by the processor, cause the processor to further perform operations comprising:

receiving an indication from the analyst user that the suspicious information does not comprise the harmful information; and

determining that the suspicious information is acceptable information.

19. The computer program product of claim 16 , wherein the computer-readable program code portions, when executed by the processor, cause the processor to further perform operations comprising:

storing the hash in an acceptable list comprising a plurality of acceptable signature hashes.

20. The computer program product of claim 16 , wherein the mitigation action comprises discarding the virtual container.