Patent ID: 8863288

Claim:
A method of detecting malicious software, comprising: assembling by a source system a software agent comprising at least one scan module; transferring the software agent to a target system; establishing a connection to the software agent in response to a connection request from the software agent; receiving a file of the target system from the software agent; performing at the source system a static analysis on an internal file structure of the transferred file to generate a static threat score for the transferred file, wherein the static analysis further comprises at least one of a hash calculation, a string extraction, a file structure format parsing, a file structure compiler analysis, a file structure packer analysis, a binary similarity analysis, a file certificate analysis, a callout domain name and IP address analysis, a domain name analysis, a white list analysis, and a memory analysis, and wherein the static threat score further comprises a score assigned based on the static analysis; performing at the source system a dynamic analysis on the transferred file to generate a dynamic threat score for the transferred file, wherein the dynamic analysis further comprises at least one of an emulated user interaction, an anti-virus range analysis, an evasion identification, a file and packet analysis, a running executable analysis, a service analysis, a process analysis, a registry analysis, a network activity analysis, and a memory analysis, and wherein the dynamic threat score further comprises a score assigned based on the dynamic analysis; and generating an aggregate threat score for the transferred file based on the static threat score and the dynamic threat score.