Patent ID: 9015814
Filing Date: 2015-04-21
Classification: G06F

Abstract:
1. A method for analysis of suspicious files of different formats, the method comprising: determining a file format of a suspicious file; analyzing the suspicious file by an antivirus software to determine whether the suspicious file is clean or harmful; upon determining that the suspicious file is harmful, generating a signature of the suspicious file and updating a collection of harmful files with the signature of the suspicious file; when the suspicious file is not determined to be clean or harmful by the antivirus software, selecting, based on at least the file format of the suspicious file, a configuration of a virtual machine, and analyzing the suspicious file by the virtual machine with the selected configuration to determine whether the suspicious file is clean or harmful based at least in part on: selecting a program associated with the file format of the suspicious file, opening the suspicious file using the associated program in the virtual machine, collecting data of at least one activity on the virtual machine, and analyzing the data to determine a maliciousness of the suspicious file; and wherein analyzing the suspicious file by the virtual machine with the selected configuration to determine whether the suspicious file is clean or harmful comprises selecting a signature database corresponding to the file format of the suspicious file or performing a heuristic analysis based on the file format of the suspicious file.