METHOD OF DETECTING MALICIOUS EXECUTABLES, CONTAINING INTERPRETER, BY COMBINING EMULATORS Russian patent published in 2017 - IPC G06F21/56 G06F9/455 

FIELD: information technology.

SUBSTANCE: method of recognizing malicious executable file that contains the script interpreter is proposed, according to which: executable file that contains the scripting language and script interpreter, associated with said interpreter, is transmitted to parser; commands from said script are converted into pseudocode using parser; emulation of pseudocode execution is run using scripting emulator, and the result is recorded in log of emulators; during the emulation process at least one transition of pseudo-code in native code is discovered, and emulation process is switched on native code emulator using parser; for each detected transition emulation of native code execution is run through native code emulator and result is recorded in log of emulators, and at the end of emulation of native code execution process, emulation process is switched to emulator scripts using parser; said executable file is recognized as malware when malicious behavior is detected in the analysis of log of emulators using parser.

EFFECT: increasing the security of computer systems.

5 cl, 4 dwg