I need to know how anti-virus programs catch malware. Do they do it with hash numbers or not?
The most typical methods to detect a malware are the following:
- Streams of bytes. As simple as it sounds: find some specific string(s) or stream of bytes.
- Hashes. Either CRCs or similar to CRC hashes applied to some block of bytes like a section's data inside an executable file (i.e., a PE or ELF file) or the entry point. Each AV engine uses a different "CRC like" set of hashes.
- Generic detections and heuristics. Code, typically C or C++, that finds evidences and after a number of evidences it's considered "malicious". Some evidences, talking about executable files, can be some specific instructions at the entry point, the number and name of sections in the executable, where the entry point is (i.e., if it's in the last section, etc...), the compilation time-stamp, the imported libraries and functions, the entropy of the file or the entropy of some section inside an executable file, etc...
- Cryptographic hashes. A long list of MD5 or SHA1 hashes for specific malware samples. A very bad approach, BTW.
- Graph hashes. A hash generated out of the call graph of the program or out of the flow graph of some specific function.
Those are the most common techniques used to detect malware by antivirus products.
1Thank you, it´s very helpful. But, I have a sample of malware. I get it on virustotal.com and check results. If I modify the code - I´m only add NOP instruction after INT 2D instruction. Then, virustotal results are different, the many of AVs not detect as dangerous. Why?– zajko007Mar 27, 2014 at 10:49
3You probably broke the PE file you're playing with. Anyway, I'm not going to help you evading AVs. Mar 27, 2014 at 10:59
1@zajko007 - You are describing one of the ways in which malware writers evade detection. Defenders use signatures to detect malware, and attackers change the signature to evade detection. That way the same virus can be easily re-introduced to the wild after its signature has already been cataloged.– KevinMar 29, 2014 at 0:40