US 9,813,412 B1
Scanning of password-protected e-mail attachment
Guangxiang Yang, Nanjing (CN); and Zhichao Ding, Nanjing (CN)
Assigned to TREND MICRO INC., Shibuya-Ku, Tokyo (JP)
Filed by Guangxiang Yang, Nanjing (CN); and Zhichao Ding, Nanjing (CN)
Filed on Jul. 27, 2015, as Appl. No. 14/810,383.
Int. Cl. G06F 7/04 (2006.01); H04L 29/06 (2006.01); H04L 12/58 (2006.01)
CPC H04L 63/083 (2013.01) [H04L 51/08 (2013.01); H04L 63/145 (2013.01)] 9 Claims
OG exemplary drawing
 
1. In a computer, a method of analyzing an attachment, said method comprising:
intercepting a message from a sender by an antivirus software before said message reaches the intended recipient, said message including a password-protected attachment having an associated obfuscated password to open said attachment in a message body of the message;
quarantining said attachment;
generating a modified message in which the attachment is removed from the modified message and with the modified message including at least a portion of the message body containing the obfuscated password and a request for the intended recipient to provide the unobfuscated password;
sending the modified message to said recipient;
receiving, by the anti-virus software, said unobfuscated password from said recipient;
analyzing said quarantined attachment with the use of said unobfuscated password to determine if said attachment includes malware; and
taking an action with regard to said attachment based upon said analysis, including:
1) in response to determining that said attachment is not malicious, downloading said attachment to a computer of said recipient or allowing said recipient to access said attachment; and
2) in response to determining that said attachment is malicious, not allowing said recipient to have access to said attachment.