Patent ID: 8352484

Claim:
A computer-implemented method for hashing executable files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying an executable file comprising non-variable executable content that contributes to the functionality of the executable file and does not vary among instances of the executable file; identifying, within the executable file, non-executable content that does not contribute to the functionality of the executable file; identifying, within the executable file, variable executable content that contributes to the functionality of the executable file and that may vary among the instances of the executable file; validating the variable executable content by determining that the variable executable content comprises and/or refers to legitimate code, wherein the legitimate code comprises known-good code and/or a non-malware variation of known-good code; creating a normalized executable file by normalizing at least a portion of the non-executable content of the executable file and normalizing the variable executable content of the executable file without normalizing the non-variable executable content of the executable file; calculating a hash value that represents the normalized executable file.