In some cases, an application may appear “suspicious” to static analysis engine 306 due to poor programming choices made by a harmless programmer, rather than a malicious one. As one example, the programmer may have named an executable that handles playing of an MP3 file with a “.mp3” extension. This sort of filetype mismatch (i.e., that an executable is incorrectly labeled with a non-executable extension) could indicate malicious behavior (i.e., a malicious individual is trying to hide a malicious executable through misnaming the filename). Here, however, the file was inadvertently mislabeled. Static analysis engine 306 notes (e.g., with rule “File Type Mismatch” being included in the static analysis report) that there is a “suspicious” aspect to the file which warrants additional investigation during dynamic analysis to reach a conclusion as to whether the application is benign or malicious.

In some embodiments, static analysis engine 306 will conclude that the application will crash (and/or cause the virtual machine to crash) if executed. As one example, static analysis engine 306 can perform integrity checking and determine that a file is missing, corrupted, unsigned, etc. In this scenario, dynamic analysis can be skipped (e.g., with static analysis noting in report 308 that the application will crash if an attempt is made to install/execute it).

Dynamic Analysis