Patent ID: 8910286

Claim:
An automated computer-implemented method for investigating a presence of malicious code in an application program stored on a subject computer system, the subject computer system including a processor, memory, and an operating system, the method comprising: providing a first emulator module for emulating the application program wherein instructions of the application program are carried out sequentially, and wherein system functions called by instructions of the application are simulated in an abbreviated fashion wherein fictitious results representing completed execution of each called system function are returned in lieu of actual execution of that called system function; providing a second emulator module for emulating called system functions that are user-mode system functions, wherein instructions of the called system functions in response to execution of the application program instructions includes sequential execution of the called system function, including branching operations and function calls taking place within the instructions of the called system function; emulating instructions of the application program by the standard emulator module; detecting, among the instructions of the application program, a call to execute a system function of the application program; in response to detecting the call to execute the system function, determining whether the called system function is to be emulated according to the first emulator module or the second emulator module; in response to the determining, emulating the called system function by either the first emulator module or the second emulator module according to a result of the determining; and analyzing results of the emulating of the application program instructions according to the first emulation module for any presence of malicious code.