I have read that some viruses -in order to avoid AVs- use crypters to encrypt their code so that the AV can't detect them. so as a countermeasure, AVs are programmed to look for the crypter -in the case of crypted virus - which is usually contained in the malware's body.

So, my question is : How does an AV differentiate between malware's crypters and normal cryptographic functions which might be contained in a legitimate app ?

1 Answer 1


Crypters and legit crypto common in apps are very different and have very different signatures.

Binary executables can't just be "encrypted" because they won't be able to be executed by the CPU or OS. Crypters are an obfuscation tool used to turn your code into very hard to read and reverse engineer code. This is done with a variety of methods and most don't involve the kind of "crypto" you would find in legit applications.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .