0

When anti-virus software compares an MD5 signature for malware, does it execute the malware on my computer in order to generate the appropriate signature to compare against?

[ORIGINAL QUESTION] MD5 has been used to detect malware for a long time. I know it is quiet outdated now due to several advanced techniques like polymorphism, changing of bits etc.,

But when one one use MD5 will it execute the malware to generate hash value?? it seems to me like it is executing the application on generating the hash value?

Recently, I found "finding a specific string" is the replacement for MD5 but with the knowledge in programming how to get the strigs in an executable or something?? Do antivirus has its own decompiler or something?

I am well aware of Heuristic and Sandbox technologies....

NOTE: This forum contains a 100's of question like this(e.g How to write AV signatures) but I find no answer for this ...

  • I am asking, will the malware be executed on generating MD5 hash? – VISWESWARAN NAGASIVAM Feb 21 '16 at 18:19
1

No. Unless there's a vulnerability in the File Stream reader (unlikely), you'll never be executing the malware in order to validate the hash. You are simply reading the contents of the executable to verify whether or not the MD5 hash is a match.

Reading is not the same as execution, and neither is writing.

Note that it's quite possible to fake the MD5 hash value because of collisions. This also doesn't help against an attacker that adds/renames methods in a virus program's source code, and who then recompiles the executable, thus producing an entirely different hash output.

  • Kindly see my original question(without edit) – VISWESWARAN NAGASIVAM Feb 21 '16 at 18:31
  • Writing AV signatures is very broad. Also, you should not edit your post to add additional questions unless you're further clarifying it. Instead, ask another question. However, I have a feeling this is far too broad because there are a lot of different ways to create AV signatures. – Mark Buffalo Feb 21 '16 at 18:38
  • No, I am just asking do antivirus has its own decompiler or not? – VISWESWARAN NAGASIVAM Feb 21 '16 at 18:40
  • Some may, some may not. How can I know what a specific anti-virus vendor uses, let alone all of them? Again, this is too broad. – Mark Buffalo Feb 21 '16 at 18:44
  • This question seems to jump from, "Does checking MD5 values execute malware," to, "how do I create an AV signature," to, "does an AV have it's own decompiler or not?" It's now unclear what you're asking. If you have additional questions, you should ask in a separate question, and try to stick to something that isn't too broad. – Mark Buffalo Feb 21 '16 at 18:53
1

No, signature based anti-virus systems don't need to execute the malware in order to generate a specific signature. They read the file contents, without executing it.

However, behaviour based anti-virus systems may execute malware using a sandbox, monitoring the behaviour of the application, and using that to determine whether an application is safe to execute normally.

0

MD5 signature of a malware that your antivirus receives it by updating is a hash and when you have a new file(Data in image) in your computer,similar to below image:

enter image description here

your antivirus hashes new file(Data) (like checksum of downloading file) and compares the result with all saved hash that your antivirus received by updating,and this work doesn't need execute the file (imagine checksum of downloading file)

NOTE:your antivirus receiving hash of all new detected malware in form that they are signing with your antivirus company and with a collision-resistant hash function,every file has a unique hash so this hash can be similar to a signature.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.