Patent ID: 9348998
Filing Date: 2016-05-24
CPC Classification: G06F

Claim Text:
1. A method for analyzing suspicious files in different formats, the method comprising: providing a plurality of virtual machines configured to analyze a plurality of suspicious files with different formats and a master virtual machine configured to allocate malware analysis tasks to the plurality of virtual machines; determining, using an antivirus software, if a suspicious file is clean or harmful; and when the antivirus software fails to determine whether the suspicious file is clean or harmful: allocating, by the master virtual machine, based on at least a file format of the suspicious file, the suspicious file to a virtual machine selected from the plurality of virtual machines for a malware analysis; opening the suspicious file using a file format associated program in the selected virtual machine; collecting data of at least one activity on the virtual machine, wherein the data comprises information about at least one of an application programming interface (API) call and/or memory associated with a process opening the suspicious file; and determining, by the virtual machine, the maliciousness of the suspicious file by analyzing the data using a signature database containing signatures specific to the file format of the suspicious file, and/or by performing a heuristic analysis using at least one file format specific heuristic algorithm.