Patent ID: 8763128

Claim:
An apparatus for detecting a malicious file, comprising: a processor; and a memory for storing computer executable instructions that, when executed by the processor, cause the processor to implement: a program driving unit for inputting an execution address of a command executed by driving a program corresponding to a non-executable file; an address storage unit for storing normal address range information in accordance with the driving of the program; and a maliciousness determination unit for determining whether the non-executable file is malicious depending on whether the execution address is not within the normal address range information; wherein the maliciousness determination unit determines: in response to the execution address is not within the normal address range information, whether or not a memory region indicated by the execution address has execution properties, and determines whether the non-executable file is malicious based on the determination result; in response to the memory region indicated by the execution address does not have execution properties, whether the non-executable file is malicious by checking whether an abnormal event occurs due to an execution of a code stored in the memory region indicated by the execution address; in response to the abnormal event does not occur, whether the non-executable file is malicious by checking whether an execution address from the next of the execution address to a predetermined operation is within the normal address range information; and in response to the memory region indicated by the execution address is determined to have execution properties, the non-executable file to be normal.