When scanning a downloaded file, does AV search the malicious source code or assembly code to identify malicious code?

Are there any online resources that give detailed analysis of how AV scans files, finds malicious matches and then isolates the program?

When things like veil-evasion obfuscate malware, is it hiding the source that gets compiled, the machine code or something else? Is there any information on this online?

  • 1
    how would it scan source code? malware infects via a compiled binary... – schroeder Dec 20 '15 at 22:20

Malware is not released as source code. Otherwise an AV can be developed to stop it and analysis on it can be done. If you obfuscated the source how could you compile it? Veil-evasion is obfuscating shell-code which is a string of machine code instructions. Or in other words some sort of executable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.