0

My antivirus software has detected an EXE downloaded from Internet as infected with virus Malwr.Heur.MSILPerseus. It has quarantined it. However, I wanted to decompile & study it's code. Will it be safe to decompile the EXE using Telerik JustDecompile to view it's source code?

2 Answers 2

2

That depends on how advanced the malware is. Most likely it will be safe, although it may be highly obfuscated and difficult to understand in a decompiler. There is a small chance that it is intentionally designed to execute correctly on real hardware, but exploit a bug to escape sandboxes or gain extra privileges on a decompiler. If you are simply asking if a decompiler needs to execute a program in order to decompile it, no it does not. It is, in theory, completely safe.

1

Yes and no. You theoretically would be safe, but it's not ideal.

The virus could have especially crafted exploits for this decompiler (or even ILDASM) - although the chances are slim, they may escape the sandbox (as stated by anon).

There's a slight chance it's not obfuscated as some sorts of obfuscation may trigger victim's anti-virus.

The safest scenario would be to open it through a VM with no internet connection. But again, if you are REALLY paranoid and don't trust sandboxes/vms, well, let's hope you have some computers laying around.

I'm not sure if it's possible to debug with telerik's justdecompile, but you can with dnSpy. So be careful: don't press the shiny-debug-button unless you've analysed it carefully.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .