1. A cryptographic block identification apparatus comprising: processing circuitry to analyze an execution trace in which an execution step of malware is recorded, calculate an evaluation value representing cipher likeliness of the execution step based on whether or not an operation type that characterizes cipher likeliness is included in the execution step, and extract an execution step where the evaluation value exceeds a threshold L, as a block candidate which is a candidate of a cryptographic block, and to identify a region of the execution trace in which block candidates are consecutive beyond a threshold M, as a cryptographic block.