Patent ID: 9646158
Date: 2017-05-09
CPC Classifications: G06F

Claim:
1. A computer-implemented method for detecting malicious files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a length of at least one line within a textual file; determining, based at least in part on the length of the line within the textual file, a likelihood that at least a portion of the textual file has been encrypted, wherein the determining comprises: determining a number of lines within the textual file that are of the same length as the length of the line; and determining the likelihood that at least a portion of the textual file has been encrypted based on the number of lines within the textual file that are of the same length as the length of the line; determining, based on the likelihood that at least a portion of the textual file has been encrypted, a likelihood that the textual file is malicious; and performing a remediation action based at least in part on determining the likelihood that the textual file is malicious.