How dangerous can a file be with no detected malware?

Question

Let's say there is file which successfully passed all scans by all antivirus software there is on VirusTotal. Does it mean that it can't be dangerous. If no, what kind of dangers we can expect?

Answer 1

It is entirely possible for a file that is not detected by any scanner to still be malware. In fact, I would expect that most new malware starts out that way! Keep in mind that the bad guys have access to antivirus software too. And they will absolutely take advantage of that by making adjustments to their malware until no antivirus software detects it. (Granted, they wouldn't be able to test with Virustotal or any online scanner that would send their file to antivirus companies for analysis, but they can still go a long way testing with offline scanners.)

After the malware is released to the world and gains meaningful distribution, antivirus companies will eventually notice it and add it to their databases. But if you're unlucky enough to be among the first few people to encounter a new piece of malware, it's quite possible that no antivirus software will detect the file as malware when you first encounter it.

It gets worse. Sophisticated attackers (e.g. nation-states) often distribute malware to a very small group of select targets. By intentionally limiting distribution, it can take years or more before any antivirus company catches on. Most people will never be the target of sophisticated attacks like this, but if you happen to be one, antivirus software will be very ineffective.

In conclusion: If many antivirus programs flag a file as malware, it's a good sign that it's malware. If no scanner flags a file as malware, you cannot conclude anything.

Answer 2

There are many information out there on how write or transport malware in order to bypass antivirus and other security products. And since attackers and vendors of security products continuously improve their products there will always be some some malware which passes AV, i.e. there will be no AV which is able to protect against every known and unknown malware without also having an unacceptable high false positive rate (i.e. blocking everything definitely blocks all unknown malware too but is not really useful).

The risks of letting such malware through are no different from letting the detected malware through. You just need to be prepared that your network or machine will be compromised at some time and should be able to detect successful attacks early and quickly recover from these.

In general the risk depend a lot on the context where this file was received and what kind of file this is. If it was an expected file send by a trusted person the risk is comparably low though it might still be that the senders system might be compromised and embeds malware into files. If it is a file downloaded from some uncommon or even illegal site on the internet the risk is much higher since such sources are regularly used to spread malware. If this is a pure text file (plain text, no Office document) or image the risk is low since it would require some bug in the local application or OS to execute some embedded malware. If it is instead an executable file, Office document, screensaver or similar the risk is much higher again etc.

Answer 3

I'll add to the other good answers here that it is best practice to store exe's long term and rescan them regularly as signatures are updated.

As for the possible dangers, it might do what you are expecting it to do and nothing more. It could do what you are expecting and also be a first stage that establishes persistence in your system then phones home for more instructions. It could be destructive on it's own

Use your best judgement based on the source and the potential risk to your system/environment.

Answer 4

Fresh code will not be flagged as malware, at least not by signature scanning (the most common form of analysis), someone needs to add the signature. Dynamic analysis can catch it, but there are ways around that too.

Also, even old malware, with signatures on almost all antivirus, can be cloaked with the right tools. A polymorphic crypter can make malware immune to signature scanning/static analysis and there are ways around dynamic analysis/emulation.

That said, you can never be 100% sure an executable is malware or not unless you checked the source and compiled it yourself.