Why don’t « hackers » (or more accurately, « virus maker ») just do repackaging over their malware to by-pass antivirus software? Because it resolves the issue of the virus signature (kind of hash), doesn’t it ? How can anti-virus software detect these kinds of easy modifications?

  • 2
    Anti-viruses also insert hooks into lots of system level function calls. If they detect abnormal application behavior they flag the process as malware.
    – RoraΖ
    Commented Feb 16, 2015 at 13:41

2 Answers 2


File hashes are by far not the most helpful method of detecting malware (unlike a couple of decades ago). Today, malware recognition (and sometimes classification) is heavily based on real-time heuristical analysis of its operations. This analysis deals with lots of data, which mostly consists of the system calls performed by the application, and their order. The system calls are tracked via a technique called hooking.

Of course, other things are taken into account. For example, most malware authors out there fail dramatically with their packers and cryptors, making it obvious that a file was, well, packed/crypted. And some just use well-known packers/cryptors that generate files which are easily recognized by antiviruses.


They do, you can lookup Metamorphic code(http://en.wikipedia.org/wiki/Metamorphic_code) and Polymorphic code(http://en.wikipedia.org/wiki/Polymorphic_code). They are techniques to make malware harder to detect by changing the code each time it's executed.

Most AV-products rely on hashes, the other way to detect malware is by using heuristic scanning where they look at how the software behaves, this is however not perfected and can give a lot of false positives.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .