Patent ID: 8578495

Claim:
A method for analyzing executable files on a computer, comprising: initiating, with an operating system of the computer, execution of a loader-process, wherein the loader-process has a memory space controlled by the loader-process; loading, using the loader-process, code of a first executable file into the memory space; executing the code of the first executable file in the memory space of the loader-process, wherein the code of the first executable file unpacks other packed code to generate unpacked code, the unpacked code including at least one system call; analyzing the unpacked code to assess whether the first executable file is a pestware file; enumerating dynamic link libraries (DLLS) that have been loaded by the operating system for the loader-process; patching at least one export address table of a dynamic link library (DLL) associated with the loader-process so that the patched export address table refers the unpacked code loaded by the loader-process back to code associated with the loader module instead of functions provided by the operating system; patching at least a portion of a function that at least one export address table points to so that the patched function refers an attempted access by a pestware process back to the loader-process, wherein at least one or more of a patched function and a patched DLL points to a location outside of the loader-process but within the loader-process's address space; executing the unpacked code in the memory space of the loader-process; routing, in response to determining the at least one system call is safe, the at least one system call of the unpacked code from the memory space of the loader-process to the operating system of the computer for execution while the unpacked code is executed by the loader-process; and clearing the memory space of the loader-process while maintaining the loader-process in a memory of the computer.