0

Basically, I'm looking for an interface where the input would be the name of a malware, or its signature, and the output would be "malware found in the database" or "malware unknown"

The tool must search in my own database (which could be outdated or have miscelaneous problems). This is to test my own, current, specific installation, not Kaspersky as a brand.

1

Simple google's virustotal.com includes kaspersky. Upload your file there, and see what kaspersky says, along with dozens of other av.

There is a size and rate limit, but you can sign up for a professional account if you need to do mass scanning.

Also there is an API you can use for scanning.

Using the virustotal API you can also use hash of the file. There are 3 acceptable hashes, that I recall, one of which was SHA2. I think you can submit all 3 for the same file if you wish.

They have a software developers kit that might help. https://usa.kaspersky.com/antivirus-sdk

However, be prepared to PAY $$$$!

  • OP says input is only the name of the malware or its signature. I don't think Virustotal can give the results by name or signature of malware. – pri Nov 20 '17 at 13:14
  • How about the same for my specific installation ? (my databases could be outdated) – ychaouche Nov 20 '17 at 13:14
  • @PriyankGupta Using the Virustotal API you can submit a SHA2 hash, and get a result. There are 2 other acceptable hashes, but forgot what they are. It may ask you to upload file if it is not already in there DB, but this is as close as we come. – cybernard Nov 20 '17 at 13:33
  • @cybernard Yes, that's true. But is signature of malware and the hash of a file same? I guess if there're 2 files infected with the same malware, their hashes might be different, but their malware signature should remain the same(in cases of primitive malware. These days malware has the capability to change the signature as well, I suppose). But yeah, that's as close as we can get with Virustotal. – pri Nov 20 '17 at 13:45
  • @ychaouche usa.kaspersky.com/antivirus-sdk This is the only other way that might work. However, I don't know, but I suspect you will have to pay, possibly a lot, for it. – cybernard Nov 20 '17 at 13:47
1

You'll have a problem with submitting a name of malware - what's the name? Not every piece of malware has the same name. Now that black hats are getting more professional, they're getting a lot better at hiding their work and finding malware is a lot more work. Even with polymorphic malware, submitting a signature or file hash makes an assumption that someone else has discovered the malware, with the same signature, submitted it to a security company, and a definition has been written for it with a corresponding entry into a database of known malware.

It used to be with Symantec/Norton that you could look at the client and see which pieces of malware were known. I haven't used the product in years so I couldn't tell you if that's the case any more.

I have to agree with @cybernard about VirusTotal - I think that's about as good as you're going to get.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.