144
You probably made it by accident with a botched shell command. I've done stuff like that myself. As a result it is probably filled with innocuous data. Here are a few reasons why I would guess it is not malicious:
1.5 GB would be an extremely large virus. Since viruses are usually transmitted over a network, smaller is better.
It isn't executable.
Malware ...
25
I'd start with history | grep sudo from the terminal and look at the most recent sudo commands to see if any are malformed.
It's your home directory.
You haven't said it has special ownership so I'll assume you own it.
It's almost certainly a botched shell command, so you probably made
it from the terminal.
It might be something created by a script but it's ...
25
Does anybody have any tips on how to proceed investigating this file?
Since file doesn't recognize the "data" as an executable, it will be difficult to try to analyze dynamically (by running it) unless you can find the proper entry point.
Another standard Linux tool you could try is:
stat
This will give you a little more of the metadata information than ...
11
I think the other answers cover nearly everything already (and have already solved the mystery). One additional thing to try if you are still unsure about deleting it is to do a scream test. You won't necessarily get a resolution as to the source of the file, but you can have some confidence it is safe to remove.
Rename the file to something else and see if ...
5
You could try "hexdump -C -n 512" to see if anything pops out at you in either the binary or ascii dump. It could be some mix of binary data and text data. Like a wget of a script that you mistyped, the hexdump might allow you to see some of the script.
4
If I had the means to automatically detect a 0-day exploit in a piece of software, the vendor of that software has the same potential, thus these exploits would be caught before the software was ever released.
Such things are done, of course, and they are called Source Code Analysis. They do exactly what you are trying to do: Automatically look for ...
3
Generally speaking, the answer is no. There's a risk that a malicious archive will exploit a bug in your archive software to open a file, but if your software has such a bug then attempting to execute a script is actually relatively safe, as there's lots of ways to block that (you'd have fewer options it if just ran an executable or took over the archive ...
3
It sounds like you need simple Write-Once-Read-Many-times (WORM) media. The most common media type that fits this description would be DVDs. If you trust that the DVD-R discs are actually blank (which will be the case if you get them from any reputable source), then you can write the video to disc, eject the disc, and never have to worry about it again. DVD-...
3
I'll go with a bit of an unorthodox suggestion. Don't connect storage media directly to the laptop at all. Treat the laptop as completely untrustworthy, and potentially disposable.
Quite simply: pretty much every modern, general-purpose, digital data interconnect can be used to make your life miserable if the device at the other end is untrustworthy. You'd ...
2
This is a very odd situation but I would take the following steps to understand what is on the card:
Create a clean VM (Windows since this is the most popular OS and if there is malware it is probably compatible with Windows) and disconnect it from the host in every way
Get a SD Card reader and mount it to the VM
Insert the SD Card and see what's on it
If ...
1
It is not necessary that a pattern of bytes in the code of malware represent the signature.
A signature in general, helps us identify the malware uniquely based on its characteristics. Below are the characteristics that go into consideration while defining a signature for the malware.
Network Based: This includes comparison of network traffic with known
...
1
You can also try head and see the first few lines of the file. The first few characters could reveal something about the file type. See magic number for more information.
Only top voted, non community-wiki answers of a minimum length are eligible
