My company just got a worm. The specific one is beside the point, but I linked a couple pages that I think describe the worm / virus below. We're getting lots of emails to Outlook asking us to open documents.

For fun, I want to do a static analysis / dynamic analysis in a virtual machine at home. I know the rule of security is that it's "never safe", but can I practically assume that downloading the attached zip file will be safe if I don't run it?

  1. Symantec
  2. Malwr
  • 3
    So, your question boils down to: how to safely download malware for analysis?
    – schroeder
    Commented Nov 13, 2014 at 18:34
  • I guess you could say that. That's a little broader than my question, as I know it's in an email attachment in my inbox. Commented Nov 13, 2014 at 18:35
  • 1
    So, you want to safely transfer malware from your work machine to your home?
    – schroeder
    Commented Nov 13, 2014 at 18:36
  • Well, you need to run it if you want to do dynamic analysis. Are you talking about specifically downloading it on your work machine to transport home, as opposed to the actual analysis work?
    – Xander
    Commented Nov 13, 2014 at 18:37
  • Yes, @Xander, I want to download it and transport it home. Which... I guess is unnecessary, as I can forward it to my email address at home and download it onto the virtual machine. Commented Nov 13, 2014 at 18:40

2 Answers 2


Most email virus require to be executed through either of these methods:

  1. The email software and/or the operating system automatically runs the file when it sees it. This is the case for pictures that exploit flaws in the picture-rendering libraries: the software processes the picture automatically (if only to show it as a thumbnail), triggering the exploit.

  2. The gullible human user is induced into running the thing.

Most email virus follow the second path, since it is much easier. Flaws in software libraries are reported and patched by vendors; flaws in the human brain are never fixed. Typically, the file will be called ".zip.exe" (the user will just see ".zip" and think "this is a Zip archive, not an executable), or ".scr" (the user is not aware that "screensavers" are actually executable files in the Windows world). When the virus is of the second kind, downloading the file is safe, as long as you take care not to execute it. Beware of double-clicking it !

If you can arrange for a transfer without downloading it on your work machine, this would be safer. For instance, if you can access your emails through a Web portal, then do that from, say, a machine running Linux (could be a VM). As a rule, Windows virus don't impact Linux, and vice versa.

  • Thanks. Scenarios like the picture exploits were what I was worried about. Commented Nov 13, 2014 at 19:38

I will answer the question: How do I transport malware to host for analysis without it being deleted or tampered with during transmission (due to Email or A/V products)?

To properly transport known malware, in a secure manner, you must first get it downloaded without host OS deleting because A/V software detected it. You can "pause" host A/V in most cases, or you can download onto a host without A/V installed.

The second step is to wrap it securely for transport. To do this, you must place malware in a zip file, and then password protect the zip file. The common password used by most A/V vendors is "infected" without quotes. Most A/V vendors will actually ignore Zip files with this password, as they assume it is meant not to be deleted, but transported for further analysis. (Intel Security and Symantec come to mind).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .