How should I decide file is malware or not. Before reverse engineering any file, I should be suspect the file. What are the various ways to decide if exe is malicious?
Thanks
asked Jun 5, 2014 at 13:33
Add a comment
|
1 Answer
This is a million dollar question and I doubt anybody will be able to provide a convincing answer. There are many methods used by antivirus software & analysts.
One is to perform a stupid matching with known malware signatures. Another could be to statically analyze the application, extract the control flow (by reconstructing the CFG) of the application and deploy heuristics & pattern matching algorithms in order to determine if the application performs suspicious tasks. This can usually be done after analyzing known malware & building profiles of their behaviors (suspicious syscall call graph, ...).
There are numerous techniques and this field is still open for research (this document describes an interesting one), some are extremely advanced and may necessitate sharp mathematical skills, and others are hard to program. Mainly, because none of them follow the standard algorithmic approach and rather use machine learning, genetic algorithms, and sometimes AI.
I suggest you going through this Securelist article, and this publication too if you're interested by more material.
