I am doing some android malware analysis work and downloaded many android samples in virus share, but I found some of them are windows malware e.g. labeled 'win32' or something.

Are these windows malware samples able to execute automatically in my computer even if I didn't add a proper extension name for them e.g '.exe'?

I am afraid it may damage my computer or leak some private data...

The samples that I downloaded is from this zip file. enter image description here

To simplify the question that I want to ask is: Whether a sample that has no extension name can excute automatically?

  • 3
    Possible duplicate of How can I analyze a potentially harmful binary safely?
    – julian
    Feb 10 '18 at 13:50
  • In the past this was impossible, but then Windows, among other OSes, might hide the extension, so you think it's not there while it is :) So if you're sure the extension is not hidden then nope. Then again, I haven't touched Windows for years, this guy says the opposite superuser.com/a/690608 Feb 12 '18 at 0:12
  • Thx, Vitaly. The samples need to add the extension name and I didn't run the cmd script. xD @VitalyOsipov
    – Sayuki
    Feb 12 '18 at 11:54
  • To be on safer side, download them in an sandbox environment (VM)
    – S Nikale
    Jul 14 at 18:28

The simplest and most common type of malware depends on you executing it, but malware can target vulnerabilities in any program that processes the data.
There are a few cases where simply downloading a file without opening it could lead to execution of attacker controlled code from within the file. It usually involves exploiting a known vulnerability within a program which will handle the file in some way. Here are some examples:

  • Windows will try to extract information from the file to display the icon and preview when looking at the folder inside explorer (such as PDF or image thumbnail). One example was the Windows Metafile Vulnerability which could be exploited only by previewing the file in explorer.

  • Another attack vectors is the builtin Windows Search. To extract the information necessary for a full text search Windows will scan the files in the background and use the file parser to extract the content. A bug in the file parser can thus lead to code execution.

  • The file targets a vulnerability in your antivirus which triggers when the file is scanned
  • The file targets a vulnerability in your file system such as NTFS where the filename or another property could trigger the bug
  • A library file (ex. dll) could get executed when saved to the same directory where an application vulnerable to binary planting is executed from
  • Thanks, maybe it's better to buy a new hard driver.. but the samples have been deleted the extension name, so I am wondering if they can still excute..
    – Sayuki
    Feb 11 '18 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.