I have to archive (and in some cases analyse) malicious files that were able to get in our company. What precautions should one take for handling these files? Given that the files won´t be executed (this happens in a seperate environment) but are just stored and get opend in i.e. Notepad++, is a Virtual Machine really necessary?

  • 3
    How sure are you that Notepad++ doesn't have any bugs which could be triggered by particular byte sequences in opened files?
    – Matthew
    Feb 27, 2017 at 9:30

1 Answer 1


Not using a VM will leave you totally dependent on the static analysis programs and any other program (hex editor, text editors and so on) you use. This is dangerous. In my opinion, too dangerous. Like Matthew said, any bug in, say notepad++, will put your archiving machine at risk of being attacked when all you think you are doing is analyzing the file.

Considering these files are known to be malicious, I wouldn't take the risk. Not to mention the human error factor - someone accidentally running a malicious script by double clicking on a Javascript .js file for example (which most people don't know is double-click-executable like that by default on Windows).

Furthermore, a VM will be much easier to repair in case of a malicious program wreaking havoc. With snapshots you can easily undo any damages.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .