0

Bitdefender detected

  1. .class -- File path: ...\tetra-1.12.2.jar => .../GuiStats.class -- Threat name: Java.Trojan.GenericGBA.31135
  2. .tif -- File path: ...\crash-81154...60f8.tif -- Threat name: Exploit.CVE-2015-5097.Gen

2 is actually part of a Python package, Pillow, downloaded via terminal with the standard installer (Windows 10).

Executables can conceal themselves by changing the extension, but what if they're actually not executable? Is this possible (if so, how does it work), or a definite false positive?

1
  • 1
    class files and thus jar files contain Java byte code. Those files are not executed but interpreted by an installed Java Virtual machine. And for the tif file, PDF files can contain images, therefore CVE-2015-5097 might be caused by an specially crafted image embedded into a PDF file. If such a files exists extracted as separate file a virus scanner may be able to detect it.
    – Robert
    Commented Apr 27, 2022 at 7:23

1 Answer 1

1

You asked two questions in one so I'll focus on the second (the second Bitdefender flag looks like a false positive but I don't have enough information to confirm that, and you might want to check out the first...).

Not Executable Malware

Fileless malware exists, where the malicious party does everything necessary in RAM without touching the disk (using Bash in Linux or Powershell in Windows). Also, malware can be distributed in a mostly encrypted/obfuscated state, so they may not technically qualify as an "executable" even though they contain code (the packer/cryptor stub - more info on packing).

2
  • Interesting, thanks. From what I understand, metamorphics still require an executable - then why not mark that executable? Ingredient easier to detect than the chef? Commented Apr 26, 2022 at 21:10
  • @OverLordGoldDragon Apologies, my explanation was slightly incorrect and I will edit it. Metamorphic viruses have "stubs" that unpack them, which are technically executable however all of that is "packed" as one file, and if the AV is using static, signature-based analysis, will not catch the executable because the overall signature is changing.
    – belkarx
    Commented Apr 26, 2022 at 21:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .