1

When anti-virus software compares an MD5 signature for malware, does it execute the malware on my computer in order to generate the appropriate signature to compare against?

[ORIGINAL QUESTION] MD5 has been used to detect malware for a long time. I know it is quiet outdated now due to several advanced techniques like polymorphism, changing of bits etc.,

But when one one use MD5 will it execute the malware to generate hash value?? it seems to me like it is executing the application on generating the hash value?

Recently, I found "finding a specific string" is the replacement for MD5 but with the knowledge in programming how to get the strigs in an executable or something?? Do antivirus has its own decompiler or something?

I am well aware of Heuristic and Sandbox technologies....

NOTE: This forum contains a 100's of question like this(e.g How to write AV signatures) but I find no answer for this ...

Improve this question
1
  • I am asking, will the malware be executed on generating MD5 hash?
    – VISWESWARAN NAGASIVAM
    Commented Feb 21, 2016 at 18:19

3 Answers 3

Reset to default
2

No. Unless there's a vulnerability in the File Stream reader (unlikely), you'll never be executing the malware in order to validate the hash. You are simply reading the contents of the executable to verify whether or not the MD5 hash is a match.

Reading is not the same as execution, and neither is writing.

Note that it's quite possible to fake the MD5 hash value because of collisions. This also doesn't help against an attacker that adds/renames methods in a virus program's source code, and who then recompiles the executable, thus producing an entirely different hash output.

Improve this answer
5
  • Kindly see my original question(without edit)
    – VISWESWARAN NAGASIVAM
    Commented Feb 21, 2016 at 18:31
  • Writing AV signatures is very broad. Also, you should not edit your post to add additional questions unless you're further clarifying it. Instead, ask another question. However, I have a feeling this is far too broad because there are a lot of different ways to create AV signatures.
    – Mark Buffalo
    Commented Feb 21, 2016 at 18:38
  • No, I am just asking do antivirus has its own decompiler or not?
    – VISWESWARAN NAGASIVAM
    Commented Feb 21, 2016 at 18:40
  • Some may, some may not. How can I know what a specific anti-virus vendor uses, let alone all of them? Again, this is too broad.
    – Mark Buffalo
    Commented Feb 21, 2016 at 18:44
  • This question seems to jump from, "Does checking MD5 values execute malware," to, "how do I create an AV signature," to, "does an AV have it's own decompiler or not?" It's now unclear what you're asking. If you have additional questions, you should ask in a separate question, and try to stick to something that isn't too broad.
    – Mark Buffalo
    Commented Feb 21, 2016 at 18:53
1

No, signature based anti-virus systems don't need to execute the malware in order to generate a specific signature. They read the file contents, without executing it.

However, behaviour based anti-virus systems may execute malware using a sandbox, monitoring the behaviour of the application, and using that to determine whether an application is safe to execute normally.

Improve this answer
0

MD5 signature of a malware that your antivirus receives it by updating is a hash and when you have a new file(Data in image) in your computer,similar to below image:

enter image description here

your antivirus hashes new file(Data) (like checksum of downloading file) and compares the result with all saved hash that your antivirus received by updating,and this work doesn't need execute the file (imagine checksum of downloading file)

NOTE:your antivirus receiving hash of all new detected malware in form that they are signing with your antivirus company and with a collision-resistant hash function,every file has a unique hash so this hash can be similar to a signature.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .