Patent ID: 8402541

Claim:
At a computer system, a method for determining whether a data file not expected to include executable code is suspected of containing malicious executable code, the method comprising: accessing a data file, the data file indicated to be of a data type associated with an application, data files of the data type not expected to include machine-executable code; detecting a possibility that the data file includes machine-executable code by identifying that a portion of the data file corresponds to a bit pattern for at least one candidate machine-executable opcode; determining that the data file warrants further analysis based on detecting the possibility that the data file includes machine-executable code; and subsequent and in response to detecting the possibility that the data file includes machine-executable code, analyzing the data file further to determine if the possible machine-executable code is malicious executable code, including: disassembling the data file to obtain a sequence of possible machine-executable instructions comprising an initial instruction and at least one subsequent instruction, wherein the initial instruction comprises the candidate machine-executable opcode; analyzing a control flow of the sequence of possible instructions; using at least one processor to record a plurality of locations in an address map stored in at least one computer-readable medium, each location in the plurality of locations corresponding to at least one of the possible instructions in the sequence; determining whether the sequence of possible instructions comprises an execution loop by determining whether the control flow of the sequence of possible instructions returns to any location recorded in the address map; and determining whether the data file is suspected of containing malicious executable code based, at least in part, on the determination of whether the sequence of possible instructions comprises an execution loop.