Patent ID: 8996875
Filing Date: 2015-03-31
Classification: G06F

Abstract:
1. A computer implemented method for detecting malware that is signed with multiple, valid credentials, the method comprising the steps of: receiving, by at least one computer, pairs of secure hashes corresponding to a plurality of different signed applications from a plurality of client computers, wherein each received pair of secure hashes comprises a secure hash of a body of a specific signed application and a secure hash of an immutable portion of a digital signature with which the specific application is signed; comparing, by the at least one computer, secure hashes of signed application bodies received from the plurality of client computers with each other; identifying, by the at least one computer, multiple instances of a single signed application from among the plurality of different signed applications, based on comparing multiple received secure hashes of signed application bodies with each other; responsive to identifying multiple instances of the single signed application, comparing with each other, by the at least one computer, received secure hashes of immutable portions of digital signatures with which the identified multiple instances of the single application are signed; determining that identified multiple instances of the same application body have been signed with multiple signatures with different immutable portions, responsive to results of comparing, with each other received secure hashes of immutable portions of digital signatures with which the identified multiple instances of the single application are signed; and adjudicating, by the at least one computer, potential maliciousness of the signed application responsive to determining that the identified multiple instances of the same application body have been signed with multiple signatures with different immutable portions, wherein adjudicating, by the at least one computer, potential maliciousness of the signed application comprises, responsive to the received secure hashes of immutable portions of digital signatures corresponding to identified multiple instances of the single signed application not matching;