2

I have to archive (and in some cases analyse) malicious files that were able to get in our company. What precautions should one take for handling these files? Given that the files won´t be executed (this happens in a seperate environment) but are just stored and get opend in i.e. Notepad++, is a Virtual Machine really necessary?

  • 3
    How sure are you that Notepad++ doesn't have any bugs which could be triggered by particular byte sequences in opened files? – Matthew Feb 27 '17 at 9:30
3

Not using a VM will leave you totally dependent on the static analysis programs and any other program (hex editor, text editors and so on) you use. This is dangerous. In my opinion, too dangerous. Like Matthew said, any bug in, say notepad++, will put your archiving machine at risk of being attacked when all you think you are doing is analyzing the file.

Considering these files are known to be malicious, I wouldn't take the risk. Not to mention the human error factor - someone accidentally running a malicious script by double clicking on a Javascript .js file for example (which most people don't know is double-click-executable like that by default on Windows).

Furthermore, a VM will be much easier to repair in case of a malicious program wreaking havoc. With snapshots you can easily undo any damages.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.