5

Let's say there is file which successfully passed all scans by all antivirus software there is on VirusTotal. Does it mean that it can't be dangerous. If no, what kind of dangers we can expect?

  • 1
    It can be just as dangerous. The only thing you know is that it’s (much) less likely to be dangerous. – caw Jan 27 at 13:24
9

It is entirely possible for a file that is not detected by any scanner to still be malware. In fact, I would expect that most new malware starts out that way! Keep in mind that the bad guys have access to antivirus software too. And they will absolutely take advantage of that by making adjustments to their malware until no antivirus software detects it. (Granted, they wouldn't be able to test with Virustotal or any online scanner that would send their file to antivirus companies for analysis, but they can still go a long way testing with offline scanners.)

After the malware is released to the world and gains meaningful distribution, antivirus companies will eventually notice it and add it to their databases. But if you're unlucky enough to be among the first few people to encounter a new piece of malware, it's quite possible that no antivirus software will detect the file as malware when you first encounter it.

It gets worse. Sophisticated attackers (e.g. nation-states) often distribute malware to a very small group of select targets. By intentionally limiting distribution, it can take years or more before any antivirus company catches on. Most people will never be the target of sophisticated attacks like this, but if you happen to be one, antivirus software will be very ineffective.

In conclusion: If many antivirus programs flag a file as malware, it's a good sign that it's malware. If no scanner flags a file as malware, you cannot conclude anything.

  • 1
    I would add that malware authors can use a VirusTotal-like service, for a fee. There are services online that will scan any file you send, and don't submit the sample to security vendors. – ThoriumBR Jan 21 at 13:54
2

There are many information out there on how write or transport malware in order to bypass antivirus and other security products. And since attackers and vendors of security products continuously improve their products there will always be some some malware which passes AV, i.e. there will be no AV which is able to protect against every known and unknown malware without also having an unacceptable high false positive rate (i.e. blocking everything definitely blocks all unknown malware too but is not really useful).

The risks of letting such malware through are no different from letting the detected malware through. You just need to be prepared that your network or machine will be compromised at some time and should be able to detect successful attacks early and quickly recover from these.

In general the risk depend a lot on the context where this file was received and what kind of file this is. If it was an expected file send by a trusted person the risk is comparably low though it might still be that the senders system might be compromised and embeds malware into files. If it is a file downloaded from some uncommon or even illegal site on the internet the risk is much higher since such sources are regularly used to spread malware. If this is a pure text file (plain text, no Office document) or image the risk is low since it would require some bug in the local application or OS to execute some embedded malware. If it is instead an executable file, Office document, screensaver or similar the risk is much higher again etc.

1

I'll add to the other good answers here that it is best practice to store exe's long term and rescan them regularly as signatures are updated.

As for the possible dangers, it might do what you are expecting it to do and nothing more. It could do what you are expecting and also be a first stage that establishes persistence in your system then phones home for more instructions. It could be destructive on it's own

Use your best judgement based on the source and the potential risk to your system/environment.

1

Fresh code will not be flagged as malware, at least not by signature scanning (the most common form of analysis), someone needs to add the signature. Dynamic analysis can catch it, but there are ways around that too.

Also, even old malware, with signatures on almost all antivirus, can be cloaked with the right tools. A polymorphic crypter can make malware immune to signature scanning/static analysis and there are ways around dynamic analysis/emulation.

That said, you can never be 100% sure an executable is malware or not unless you checked the source and compiled it yourself.

  • A polymorphic crypter is as OBVIOUS AS WRITING ALL UPPERCASE AND BOLD!!! Sure, an AV software may not be able to detect what kind of malware is being hidden, but any popular AV can detect that something is wrong. – MechMK1 Jan 21 at 13:33
  • That will depend on how aggressive the AV is. The more aggressive an AV is, the more likely it is to detect those threats, but it will also trigger more false positives, so AVs can't afford to be overly aggressive. A polymorphic crypter using a low entropy technique and without doing weird things with the PE (Windows) can be pretty much undetectable by static analysis. – IcaroAugusto Jan 21 at 14:26
  • That would then be a universal AV bypass. If you have one, please share it with the rest of the class. – MechMK1 Jan 21 at 14:31
  • Not universal, a decent antivirus will run the program in a sandbox (dynamic analysis) and can detect it that way. – IcaroAugusto Jan 21 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.