I ran over a suspicious DLL file which originally was created by Adobe Photoshop (The license looks legit). I want to check if DLL contains malicious code which would be executed at runtime. What I already know:

  • I opened the DLL In dotPeek. DotPeek didn't support the File. This is the reason I think it's not .NET

My decompiling attempt in DotPeek

  • I read that decompiling a DLL file is hard any you will only get binary/hex code. Because of this I am wondering if it is even possible to add/edit code to a, not by the attacker created, DLL.

  • I checked the DLL with online virus analysis Tools and it mostly marked it as safe: VirusTotal scan and Hybrid Analysis Scan

How can I verify if this DLL file is save and doesn't contain any malicious code?

  • I'm honestly confused over why you have the file available for us to download. If it's a safe file created by Photoshop, you're probably breaking their ToS and maybe violating their copyright. If it's not safe, you're spreading unsafe binaries and inviting people -- who are not all professionals here -- to poke at it. And the people here generally won't check your files for you. They might explain how you can check it yourself, but it seems you're already on your way to doing that with VirusTotal and such... So... What are you asking here? – Ghedipunk Oct 2 '18 at 19:44
  • @Ghedipunk I removed the download link, like you said this is not the place to send files to people. I am asking how I can verify if this DLL file is save and doesn't contain any malicious code? I don't trust virusTotal here because a DLL executes at run-time and virusTotal is just checking on scan-time. – Nightscape Oct 2 '18 at 19:52
  • Where did you get the file from? If it's from a trusted source, why worry about that particular DLL when Photoshop has many? – Alexander O'Mara Oct 2 '18 at 19:55
  • @AlexanderO'Mara I just download a "crack" DLL for Photoshop. I already have the full version and I more intrested into decompiling this file and finding out if it contains malicious code in it. – Nightscape Oct 2 '18 at 20:30
  • You downloaded a crack DLL? Well then delete the file and use your legit copy so you don't need to worry if its malicious or not. – McMatty Oct 2 '18 at 21:16

For native code binaries, reverse engineering is hard (though not impossible). IDA (Interactive DisAssembler) is the most popular tool for disassembling native binaries back into something that is approximately human-comprehensible, though it's still not trivial to use correctly and may take some time to become proficient. The developer also publishes a decompiler, which tries to turn the binary code into something resembling C source code. Both of these are commercial (and expensive) programs, although you can get an evaluation version of IDA.

Note that even if you had the original source code (which no tool can give you), unless you are extremely adept at source code analysis there's no guarantee you'd be able to determine if the library is malicious or not. The International Obfuscated C Code Contest and especially the Underhanded C Contest are neat repositories of examples showing how hard it is to tell what a C program/library is doing, and how safe it is. That's not to say it's worthless to try, but it's far from guaranteed that you'd succeed (and you don't have the source to this binary anyhow).

There is no practical way to tell, for sure, that a binary is not malicious.

Modern malware is often heavily obfuscated (by hand and/or with a utility), both to deter reverse-engineering and to try to bypass antivirus checks. However, not all such obfuscated code is malicious; things like license-checking and DRM-enforcing libraries are generally very obfuscated as well, as are any binaries that contain highly-sensitive proprietary algorithms that the developer/publisher is trying to keep secret.

Running the binary through VirusTotal is a good idea, but all it can tell you is "would any antivirus software detect this as malicious?" and that's not enough info. Virus scanners can produce both false positives (flagging safe software as malicious) and false negatives (failing to recognize malicious software), and malware developers are well aware of the need to avoid detection by antivirus software.

Another thing to consider is how trustworthy the file's source is. Adobe is notorious for buggy (e.g. Photoshop) and/or insecure (e.g. Flashplayer) software, but as far as I know hasn't ever released anything meeting the conventional definition of "malicious" (some people count all DRM as malicious, but while I see their point I think they are diluting the term and don't personally count DRM as malicious unless it impacts anything other than the software itself, e.g. the Sony BMG rootkits). If the file has a valid digital signature from Adobe (or any other reasonably-trustworthy developer), the odds that it is malicious are much lower. If the signature is missing, invalid, or created by a third party that you don't recognize (check very carefully that the signer is who you think it is, not somebody else with a similar-looking name), then that's reason to be suspicious, especially in the last case (look-alike name trying to pass itself off as somebody else).

  • No practical way to tell if a binary is malicious? I think a few reverse engineers would disagree with you there, you don't need the original source to determine this - read the asm. Given obfuscated code there are a few tools that reverse that process as well as monitoring system calls for behavior consistent with malware or calls across the network. – McMatty Oct 2 '18 at 21:21
  • @McMatty Reverse engineering can sometimes tell you that a binary is malicious. It can't, short of an exhaustive degree of formal proof, tell you that one isn't malicious. For example, a program that exploited Meltdown could not have been determined to be malicious (without running it on an Intel CPU and seeing what happened) no matter how good your proof, if your model didn't know Meltdown was even possible. It is very hard to prove a negative in that manner, which is why I said "no practical way... for sure". With that said, I tweaked the bolded line to be clearer. – CBHacking Oct 2 '18 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.