Patent ID: 7620990

Claim:
A computer implemented system for determining whether a packed executable is malware, the system comprising: A processor; a malware evaluator for determining whether incoming data is malware, wherein the incoming data directed to a computing device is intercepted by the malware evaluator; and an unpacking module that receives a first packed executable from the malware evaluator and returns a corresponding substitute unpacked executable, without executing the first packed executable during unpacking, the unpacking module comprising: at least one substitute unpacker code segment, corresponding to a first unpacker code segment of the first racked executable, such that an appropriate substitute unpacker code segment is substituted for the first unpacker code segment of the received first racked executable to facilitate unpacking the first packed executable according to the substitute unpacker code rather than according to the first unpacker code, the first racked executable is thereby unpacked into a corresponding substitute unpacked executable that can be the same as, or different than, a first unpacked executable unpacked if the first packed executable were unpacked by the first unpacker code; an unpacking manager, wherein the unpacking manager, upon obtaining the first packed executable, selects the unpacking module for a set of unpacking module to unpack the first packed executable according to a type of the first racked executable, and executes the selected unpacking module which generates the first unpacked executable corresponding to the first packed executable, wherein the malware evaluator, upon receiving incoming data, can at least in part determine whether the incoming data is a packed executable, and if so, the malware evaluator provides the packed executable to the unpacking module such that a substitute unpacked executable, corresponding to the first packed executable, is generated by unpacking the first packed executable with a substitute unpacker code segment without executing the first packed executable, whereby the malware evaluator can determine whether the first unpacked executable would be malware based at least in part on an analysis of the corresponding substitute unpacked executable.