System and Method for Validating In-Memory Integrity of Executable Files to Identify Malicious Activity

A malicious code detection module is presented to identify potentially malicious instructions in a volatile memory of a computing device before the instructions are executed. The malicious code detection module identifies an executable file, including an .exe file, in memory, validates one or more components of the executable file against the same file stored in non-volatile storage, wherein the validation accounts for the unpacking of the executable file, and issues an alert if the validation fails.