2

VirusTotal is claiming that file contains exploit: https://www.virustotal.com/#/file/31dd9c543e653c0cacfe152f735573e85b49df519c37a32ff76469d0dee6d63b/relations

How to confirm it is not just false positive? What is possible to do here?

3
  • 1
    From those results I'd guess it was seen to be dropped by malicious APKs and has been flagged as an IOC rather than the ELF file itself being necessarily malicious.
    – Polynomial
    Oct 12, 2017 at 12:29
  • hi, thank you! I didn't quite get point about IOC, what does it mean?
    – vmg
    Oct 12, 2017 at 15:54
  • 2
    Indicator of compromise.
    – Polynomial
    Oct 12, 2017 at 20:43

1 Answer 1

1

If the file was installed by the OS package manager you can compare the hash and package signature against that of the distribution. Given that it's been flagged as a malicious apk it is likely a bad rule, but if you don't have a trusted source to compare it against you can't really be sure it's not malicious.

Ps. it can still be a malicious library, just one that doesn't have any existing detections or known badness ... ;)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .