Methods and systems for identifying potential enterprise software threats based on visual and non-visual data

Visual and non-visual elements associated with the candidate files are analyzed to determine whether the candidate files are malware. A visual element (e.g., icon) is extracted from the candidate file, and the icon's image is compared to a group of reference images associated with trusted entities. If the icon's image matches a reference image, the candidate file may be malware masquerading as trusted software. The non- visual elements associated with the candidate file are used, in combination with the visual elements, to determine whether the candidate file is malware.