Abstract: A method for identifying malware is provided. The method includes performing a static analysis of a plurality of files and for each file of the plurality of files, determining in the static analysis whether the file includes an application programming interface (API). For each file, of the plurality of files, found to have an application programming interface, the method includes determining in the static analysis whether the application programming interface is proper in the file and alerting regarding an improper application programming interface when found in one of the plurality of files. A scanner for detecting malware is also provided.

Abstract: A computer-implemented method for detecting malicious email attachments may include (1) identifying a shortcut file received as an attachment to an email, wherein the shortcut file is configured to open a target file, (2) analyzing the shortcut file to identify at least one attribute of the shortcut file, wherein the attribute comprises information about the shortcut file useful for determining whether text accurately characterizes the shortcut file, (3) identifying accompanying text in the email that characterizes the attachment, and (4) determining that the attachment is malicious by comparing the attribute of the shortcut file with the accompanying text in the email that characterizes the attachment and, based on the comparison, determining that the accompanying text does not accurately characterize the shortcut file. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method for detecting legitimate computer operation misrepresentation is provided. In some embodiments, the method comprises monitoring internet activity associated with a user computer, comparing the internet activity with suspicious feature information to produce a comparison result, wherein the suspicious feature information comprises at least one image that misrepresents at least one legitimate computer operation, identifying fraudulent software based on the comparison result, wherein the comparison result indicates a portion of the internet activity that misrepresents the at least one legitimate computer operation and mitigating activities associated with the identified fraudulent software.

Abstract: A method and apparatus for minimizing the effects of rogue security software leverages the fact that virtually all rogue security software generates malware alerts to scare the user/victim into submitting their payment information, and the fact that the malware alerts generated by rogue security software are almost never changed. In one example, a user computing system is monitored/scanned for any alerts being presented to the user. Once an alert is detected, the alert content is sampled and analyzed for defined keywords that indicate the alert is a malware alert and any alert including the defined keywords is considered a malware alert and is treated as being potentially generated by rogue security software. All malware alerts are therefore subjected to an initial malware alert analysis before the user is allowed to see, and/or respond, at least without a warning, to the malware alert.

Abstract: A method and apparatus for indentifying Icons whereby a known/clean file Icon database is created that includes Icon image data and/or .ico files associated with known icons of selected applications. The resource section of any file being transferred to, or through, a given user computing system is then stripped and scanned for .ico files and any .ico files identified are extracted. Then for each directory extracted from the identified .ico files, the relevant image data is extracted. The known/clean Icon image data is obtained from the known/clean file Icon database. The extracted relevant image data is then compared with known/clean Icon image data and, if the extracted relevant image data matches with the known/clean Icon image data to a desired level of accuracy, a status of the extracted .ico files, and/or given file, is transformed indicate a status of Icon match.