0

My antivirus software has detected an EXE downloaded from Internet as infected with virus Malwr.Heur.MSILPerseus. It has quarantined it. However, I wanted to decompile & study it's code. Will it be safe to decompile the EXE using Telerik JustDecompile to view it's source code?

2

That depends on how advanced the malware is. Most likely it will be safe, although it may be highly obfuscated and difficult to understand in a decompiler. There is a small chance that it is intentionally designed to execute correctly on real hardware, but exploit a bug to escape sandboxes or gain extra privileges on a decompiler. If you are simply asking if a decompiler needs to execute a program in order to decompile it, no it does not. It is, in theory, completely safe.

| improve this answer | |
1

Yes and no. You theoretically would be safe, but it's not ideal.

The virus could have especially crafted exploits for this decompiler (or even ILDASM) - although the chances are slim, they may escape the sandbox (as stated by anon).

There's a slight chance it's not obfuscated as some sorts of obfuscation may trigger victim's anti-virus.

The safest scenario would be to open it through a VM with no internet connection. But again, if you are REALLY paranoid and don't trust sandboxes/vms, well, let's hope you have some computers laying around.

I'm not sure if it's possible to debug with telerik's justdecompile, but you can with dnSpy. So be careful: don't press the shiny-debug-button unless you've analysed it carefully.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.