Patent ID: 11886584
Assignee: AO KASPERSKY LAB
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 7:
8. A system for detecting potentially malicious changes in an application, comprising:
at least one processor configured to:
select a first file to be analyzed and at least one second file similar to the first file, wherein the similarity of the at least one second file with the first file is based on at least one of: names of the first file and the at least one second file, and versions of the first file and the at least one second file;
for each of the at least one second file, calculate at least one set of features;
identify a set of distinguishing features of the first file by finding, for each of the at least one second file, a difference between a set of features of the first file and the calculated at least one set of features of the second file; and

detect a presence of potentially malicious changes in the identified set of distinguishing features of the first file, characterized in that the potentially malicious changes comprise at least a change that indicates a presence of at least one code loader for loading of code from encrypted files or from sections of files not intended for code storage, or from third-party servers.