Abstract: A file is received from external to the gateway device and, prior to runtime, the received file is detected as being compressed. Also before runtime, a compression type of the received file is differentiated as packed, protected, and/or archived. Identification of a specific packer, a specific protector or a specific archiver corresponding to the compression type is attempted. Responsive to successful identification, the received file is decompressed and a static type of malware analysis is selected for the received file. Responsive to unsuccessful identification, decompress the received file is attempted with a general unpacker, a general unprotector or a general unarchiver, and responsive to successful decompression, the static type of malware analysis is selected for the received file. Responsive to unsuccessful decompression, a dynamic type of malware analysis on the received file is selected.

Abstract: A file is received from external to the gateway device and, prior to runtime, the received file is detected as being compressed. Also before runtime, a compression type of the received file is differentiated as packed, protected, and/or archived. Identification of a specific packer, a specific protector or a specific archiver corresponding to the compression type is attempted. Responsive to successful identification, the received file is decompressed and a static type of malware analysis is selected for the received file. Responsive to unsuccessful identification, decompress the received file is attempted with a general unpacker, a general unprotector or a general unarchiver, and responsive to successful decompression, the static type of malware analysis is selected for the received file. Responsive to unsuccessful decompression, a dynamic type of malware analysis on the received file is selected.