1

My company just got a worm. The specific one is beside the point, but I linked a couple pages that I think describe the worm / virus below. We're getting lots of emails to Outlook asking us to open documents.

For fun, I want to do a static analysis / dynamic analysis in a virtual machine at home. I know the rule of security is that it's "never safe", but can I practically assume that downloading the attached zip file will be safe if I don't run it?

  1. Symantec
  2. Malwr
  • 3
    So, your question boils down to: how to safely download malware for analysis? – schroeder Nov 13 '14 at 18:34
  • I guess you could say that. That's a little broader than my question, as I know it's in an email attachment in my inbox. – Millie Smith Nov 13 '14 at 18:35
  • 1
    So, you want to safely transfer malware from your work machine to your home? – schroeder Nov 13 '14 at 18:36
  • Well, you need to run it if you want to do dynamic analysis. Are you talking about specifically downloading it on your work machine to transport home, as opposed to the actual analysis work? – Xander Nov 13 '14 at 18:37
  • Yes, @Xander, I want to download it and transport it home. Which... I guess is unnecessary, as I can forward it to my email address at home and download it onto the virtual machine. – Millie Smith Nov 13 '14 at 18:40
2

Most email virus require to be executed through either of these methods:

  1. The email software and/or the operating system automatically runs the file when it sees it. This is the case for pictures that exploit flaws in the picture-rendering libraries: the software processes the picture automatically (if only to show it as a thumbnail), triggering the exploit.

  2. The gullible human user is induced into running the thing.

Most email virus follow the second path, since it is much easier. Flaws in software libraries are reported and patched by vendors; flaws in the human brain are never fixed. Typically, the file will be called ".zip.exe" (the user will just see ".zip" and think "this is a Zip archive, not an executable), or ".scr" (the user is not aware that "screensavers" are actually executable files in the Windows world). When the virus is of the second kind, downloading the file is safe, as long as you take care not to execute it. Beware of double-clicking it !

If you can arrange for a transfer without downloading it on your work machine, this would be safer. For instance, if you can access your emails through a Web portal, then do that from, say, a machine running Linux (could be a VM). As a rule, Windows virus don't impact Linux, and vice versa.

  • Thanks. Scenarios like the picture exploits were what I was worried about. – Millie Smith Nov 13 '14 at 19:38
1

I will answer the question: How do I transport malware to host for analysis without it being deleted or tampered with during transmission (due to Email or A/V products)?

To properly transport known malware, in a secure manner, you must first get it downloaded without host OS deleting because A/V software detected it. You can "pause" host A/V in most cases, or you can download onto a host without A/V installed.

The second step is to wrap it securely for transport. To do this, you must place malware in a zip file, and then password protect the zip file. The common password used by most A/V vendors is "infected" without quotes. Most A/V vendors will actually ignore Zip files with this password, as they assume it is meant not to be deleted, but transported for further analysis. (Intel Security and Symantec come to mind).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.