I need to know how anti-virus programs catch malware. Do they do it with hash numbers or not?
closed as too broad by perror, usr2564301, ixje, jvoisin, asheeshr Mar 29 '14 at 5:06
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
The most typical methods to detect a malware are the following:
- Streams of bytes. As simple as it sounds: find some specific string(s) or stream of bytes.
- Hashes. Either CRCs or similar to CRC hashes applied to some block of bytes like a section's data inside an executable file (i.e., a PE or ELF file) or the entry point. Each AV engine uses a different "CRC like" set of hashes.
- Generic detections and heuristics. Code, typically C or C++, that finds evidences and after a number of evidences it's considered "malicious". Some evidences, talking about executable files, can be some specific instructions at the entry point, the number and name of sections in the executable, where the entry point is (i.e., if it's in the last section, etc...), the compilation time-stamp, the imported libraries and functions, the entropy of the file or the entropy of some section inside an executable file, etc...
- Cryptographic hashes. A long list of MD5 or SHA1 hashes for specific malware samples. A very bad approach, BTW.
- Graph hashes. A hash generated out of the call graph of the program or out of the flow graph of some specific function.
Those are the most common techniques used to detect malware by antivirus products.