Patent Document ID: 9189627
Application ID: 14086842
Patent Status: 1

Claim One:
1. A computerized method comprising: receiving an encrypted object having a Portable Executable (PE) file format; conducting a first static scanning operation on the encrypted object to decrypt the encrypted object in real-time, the conducting of the first static scanning operation comprises (A) conducting, by execution of a format detection logic by a processor, one or more logical operations at least on data associated with a first data string expected at a first location within an object having the PE file format and data within the encrypted object at the first location to produce a partial key, (B) conducting, by execution of key detection logic by the processor, one or more logical operations at least on the partial key and a first portion of the encrypted object at a second location within the encrypted object to produce a result, wherein the second location is different than the first location and the result includes a portion of data associated with a plaintext version of a second data string that is expected at the second location, (C) responsive to the result including data associated with the plaintext version of the second data string, during execution of the key detection logic by the processor, conducting one or more logical operations at least on a second portion of the encrypted object and the data associated with the plaintext version of the second data string expected at the second location to recover a cryptographic key, wherein the second portion of the encrypted object includes the first portion of the encrypted object, and (D) decrypting, by execution of decryption logic by the processor, the encrypted object using the cryptographic key to produce a decrypted object.