Patent ID: 8205263
Filing Date: 2012-06-19
Classification: G06F

Abstract:
1. A method for analyzing an unverified executable file within an antivirus engine to identify the executable file as being obfuscated by an unknown obfuscator program, the method comprising: receiving an unverified executable file comprising a plurality of obfuscated library strings and obfuscated executable code; accessing a list of a plurality of pre-verified library strings; determining if a match exists between at least a portion of one of the obfuscated library strings of the unverified executable file and at least a portion of one of the pre-verified library strings; and upon determining the absence of a match, marking the unverified executable file as being an executable file obfuscated by an unknown obfuscator program, wherein the mark represents a probability that the obfuscated executable code comprises malicious executable code.