APPARATUS AND METHOD FOR DETECTING MALICIOUSNESS OF NON-PE FILE THROUGH MEMORY ANALYSIS

摘要

According to the present invention, a method for detecting maliciousness of a non-portable executable file comprises the following steps: executing a non-portable executable file in a virtual environment by driving an application program corresponding to the non-portable executable file; extracting a script from an area where the non-portable executable file of a memory is stored when a script execution module of the application program is loaded on the memory; and determining whether the non-portable executable file is malicious or not by analyzing the script.