How to check whether a printer driver is malicious or not

Question

While downloading a printer driver from the company's website, redirected to a google drive link. Google warning says it could be malicious.

The company is MEPL- based in India, but it is using a driver of Pantum - based in China and distributing the driver through the google drive link. This seemed suspicious however, on proceeding, i found a warning from google.

On proceeding further on an obsolete system, I found multiple warnings by windows also.

I scanned the driver .exe file using quickheal antivirus however, nothing was detected.

I checked the .exe file on virustotal also, but nothing was flagged.

i checked the googledrive link only to find that the link was flagged as malicious by 3/93 vendors on virustotal.

How could I ascertain whether the .exe file is only a printer driver and doesn't contain a kind of malware embedded.

PS: i m new to the field of cybersecurity hence, can't distinguish between paranoia and awareness

Answer 1

Welcome to the community! It's good to have a sense of caution with an ever evolving threat landscape.

Paranoia can lead you to awareness through trial and victory, or let you aimlessly fall into a rathole; discernment is at times difficult, yet part of the allure in this space (my personal opinion)!

If I recall correctly it is the default nature within Drive to consider executables, some documents with links/images (PDFs) or macros (Office documents) risky, and to present the banner to keep users aprised that those documents can perform actions outside of their control. Even platforms such as that cannot fully scan everything with certainty - so it helps to inform users that they are taking a risk.

It's difficult to ever say that you can say with certainty without diving into the analysis of the driver itself - which can be a cumbersome task. A lot of tools are out there to help make this possible, although there are even scenarios where tools (such as VirusTotal) have engines that flag files as malicious errouneously or rely on community statements without validation.

I have liked the use of the following tools for expedited analysis:

• capa: Useful in situations of determining what capabilities an executable might have. For a printer driver it might be suspicious to see socket connections (unless it's a network printer) or the instantiation of a new service.
• Qu1cksc0pe: Performs a number of tests which can provide a lot of information about what the executable might do on the target system.

Suggestions:

• If you're interested in diving further, you can review a lot of information and tooling at collection pages such as awesome-malware-analysis.
• Should you choose to perform static or dynamic analysis of the sample, do so within a virtual machine with an alternate OS (e.g. Remnux), preferably isolated from your primary machine, if possible.

If you have public sources (e.g. VT) that point to the analysis of the file, you can optionally provide those for additional context and analysis, additionally providing the exact model so the community could even help you verify what's currently available out there.