Why does Kaspersky anti-virus not consider this executable as malicious?

Question

I was trying to learn file I/O and related function in C, and thus tried to create a baby-version of a virus. Following is the exact code:

#include <stdio.h>
#include <stdlib.h>

int main(void)
{
    FILE *mod_host, *fin_host;

    mod_host = fopen("host.txt", "r+");
    fin_host = fopen("final.txt", "w+");

    if (mod_host == NULL)
    {
        printf("Lucky you!\n");
        return 0;
    }

    int c;

    while ((c = fgetc(mod_host)) != EOF)
    {
        fputc(((c^2) % 94) + 32, fin_host);
    }

    fclose(mod_host);

    remove("host.txt");

    fclose(fin_host);

    rename("final.txt", "host.infected");

    printf("Sorry, you are now infected!\n");
}

What the above code exactly does, can be understood by the following pseudo-code:

open the file "host.txt"
create and open another file "final.txt"
transfer the contents of "host.txt" to "final.txt" and modify them in the latter file
delete "host.txt"
rename "file.txt" to "host.infected"

Now the program's actions and consequences are definitely malicious, and thus I expected my anti-virus (I use Kaspersky AV) to not let me run the executable created after compiling the above code. But turns out, the executable ran completely fine, did it's job, and returned 0 without Kaspersky AV giving any warnings. So, I explicitly tried to scan the executable for viruses. Again, Kaspersky AV finished the scan and reported that no malicious objects were detected, and the executable was safe to open.

Of course, the above program is not even a proper virus, and I have hard-coded a lot of things, from file names to the character modification logic, but still, it is malicious in the sense that it removes/deletes an existing file, and creates a new one (which in this case, is just full of gibberish, but it could potentially be another virus as well). Moreover, I cannot restore that deleted file even from my "Recycle Bin", since it is not present there. This does sound enough damage to me, still why doesn't Kaspersky AV consider this executable harmful? In case it matters, I am running this code on Windows 10.

Answer 1

Anti-virus programs detect malware in two different ways. First, they contain a set of patterns that match known, existing malware. Something matching one of these patterns should be definitively a piece of malware.

Second, they contain a set of heuristics which are found in many malicious programs. These are not foolproof, so they are usually weighted in some way and a program which contains several may be flagged as a potentially malicious program. When antivirus vendors make a mistake with heuristics, they do things like flag many benign programs written in Go as malware, which leads to problems. Ultimately, these are guesses and they will have both false positives and false negatives.

In your code, you are using standard C library functions that are likely to be used in a lot of reasonably portable programs. Opening a file, transforming the data, writing it to a new file, and then deleting the original is a pattern used by lots and lots of software for non-malicious purposes. I suspect a similar invocation is used in the Unix program sed when invoked with the -i option. While your code is malicious, it's also commonly used by a lot of benign software, so your antivirus won't flag it.

If your program did additional things that malware commonly does, like try to evade detection or hook the message queue, those would likely be flagged. But right now, regardless of your intent, your code doesn't look that different from benign software.