-2

I´m a student in IT security and I would like to know how the malware fingerprints work in common AntiVirus. I understand that when a malware is detected it's because the binary fingerprint is known by the AntiVirus database.

But if I split the malware in ten files in order to find and store my own fingerprint database the fingerprint is not even detected, why? How does this work?

  • no, I'm just asking why when i split a malware in 10 or 100 files my AV don't detect it anymore. I would like to know why. No obfuscation because i want to store a fingerprint database for a project. – dudule May 3 at 15:10
  • That's easy - you are obfuscating. Splitting it across multiple files means your AV cannot find the signature it expects. – Rory Alsop May 3 at 15:12
  • If i don't split it, how can i be able to identify the fingerprint ? I don't want to obfuscate or change the fingerprint. Just identify it – dudule May 3 at 15:14
  • why do you want to split it? I don't understand why you would want to. Splitting it is obfuscation. Just identify it in the file you have. – Rory Alsop May 3 at 15:15
  • 1
    I have no idea what you are trying to do here. What is being split up? What fingerprint is being stored? You create and store a fingerprint in your AV system. Then you scan a file to look for the fingerprint. If you take the malware that matches the fingerprint and modify it (by splitting it up into smaller chunks), then your fingerprint comparison process will not find it. malware vs ma . lw . are are very different strings to try to match. – schroeder May 3 at 15:41
3

For an AV that looks for a signature, splitting your malware across files means the signature no longer exists. The AV doesn't concatenate multiple files in order to speculatively match for signatures.

This is obfuscation, of a simple kind.

So if you want to scan the file for a signature, do not split it, as this prevents you seeing the signature.

  • 1
    For an IT security student this was a good lesson on why signature based AV isn't a good approach against current threats, though. – Esa Jokinen May 4 at 11:30
2

Don't bother with that "spliting".

I would like to know how the malware fingerprints work in common AntiVirus

My suggestion to you is to read how ClamAV works, you can start here.

Learn about creating signatures: https://www.clamav.net/documents/creating-signatures-for-clamav

And yeah, don't forget to try YARA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.