1. A cryptographic block identification apparatus comprising: a memory; and processing circuitry configured to acquire an execution trace by executing an execution file of malware; analyze the execution trace; calculate an evaluation value representing cipher likeliness of the execution step based on whether or not an operation type that characterizes cipher likeliness is included in the execution step; extract an execution step where the evaluation value exceeds a threshold L, as a block candidate which is a candidate of a cryptographic block; identify a region of the execution trace in which block candidates are consecutive beyond a threshold M, as a cryptographic block; analyze a communication log and output an analysis result including a key and a plaintext; identify a cipher block from among the extracted block candidates; analyze the communication log using information of the identified cryptographic block; and output the analysis result.