Systems, methods, and media for analyzing structured files for malicious content
Mechanisms for analyzing a structured file for malicious content are provided, comprising: parsing the structured file into a plurality of portions; selecting a selected portion of the portions; checking the selected portion to determine if at least one pre-condition is met; and in response to determining that the at least one pre-condition is met: decoding the selected portion to form a decoded portion; and checking the decoded portion to determine if it is malicious. In some embodiments: the at least one pre-condition can be changed; the structured file is a MICROSOFT OFFICE XML file; the selected portion is a file; the at least one pre-condition checks at least one attribute of the selected portion; decoding the selected portion comprises decompressing the selected portion; and/or checking the decoded portion to determine if it is malicious comprises checking whether a previously decoded portion of the structure file meets at least one condition.
1. A system for analyzing a structured file which is not known to be free of or contain malicious content for malicious content, comprising:
a memory; and
at least one hardware processor that is coupled to the memory and configured to:
parse the structured file into a plurality of portions;
select a selected portion of the plurality of portions;
check the selected portion to determine if at least one pre-condition is met,
wherein the at least one pre-condition is the selected portion having one of a given name, a given file extension, and a given file type; and
in response to determining that the at least one pre-condition is met:
decode the selected portion to form a decoded portion; and
check the decoded portion to determine if it is malicious.
2. The system of claim 1 , wherein the at least one pre-condition can be changed.
3. The system of claim 1 , wherein the structured file is an XML file.
4. The system of claim 1 , wherein the selected portion is a file.
5. The system of claim 1 , wherein decoding the selected portion comprises decompressing the selected portion.
6. The system of claim 1 , wherein checking the decoded portion to determine if it is malicious comprises checking whether a previously decoded portion of the structure file meets at least one condition.
7. A method for analyzing a structured file which is not known to be free of or contain malicious content for malicious content, comprising:
parsing, using a hardware processor, the structured file into a plurality of portions;
selecting a selected portion of the plurality of portions;
checking the selected portion to determine if at least one pre-condition is met, wherein the at least one pre-condition is the selected portion having one of a given name, a given file extension, and a given file type; and
in response to determining that the at least one pre-condition is met:
decoding the selected portion to form a decoded portion; and
checking the decoded portion to determine if it is malicious.
8. The method of claim 7 , wherein the at least one pre-condition can be changed.
9. The method of claim 7 , wherein the structured file is an XML file.
10. The method of claim 7 , wherein the selected portion is a file.
11. The method of claim 7 , wherein decoding the selected portion comprises decompressing the selected portion.
12. The method of claim 7 , wherein checking the decoded portion to determine if it is malicious comprises checking whether a previously decoded portion of the structure file meets at least one condition.
13. A non-transitory computer-readable medium containing computer executable instructions that, when executed by a processor, cause the processor to perform a method for analyzing a structured file which is not known to be free of or contain malicious content for malicious content, the method comprising:
parsing the structured file into a plurality of portions;
selecting a selected portion of the plurality of portions;
checking the selected portion to determine if at least one pre-condition is met, wherein the at least one pre-condition is the selected portion having one of a given name, a given file extension, and a given file type; and
in response to determining that the at least one pre-condition is met:
decoding the selected portion to form a decoded portion; and
checking the decoded portion to determine if it is malicious.
14. The non-transitory computer-readable medium of claim 13 , wherein the at least one pre-condition can be changed.
15. The non-transitory computer-readable medium of claim 13 , wherein the structured file is an XML file.
16. The non-transitory computer-readable medium of claim 13 , wherein the selected portion is a file.
17. The non-transitory computer-readable medium of claim 13 , wherein checking the decoded portion to determine if it is malicious comprises checking whether a previously decoded portion of the structure file meets at least one condition.