Scanning the malware with VirusTotal

VirusTotal is a website where you can upload suspicious files for analysis. It uses a multitude of various virus scanners, so if one scanner misses something, another is likely to find it. Here are the results of scanning the Your File Is Ready To Download_2285169994.exe file:

Here, we can see that different virus scanners classify this file in different ways. But whether it's classified as Win.Malware.Installcore, Trojan.InstallCore, or whatever else, it's still bad.

As good as VirusTotal is, you'll want to use it with caution. Don't upload any files that contain sensitive or confidential information, because it will get shared with other people.

So, what is this particular piece of malware all about? Well, it's actually a fake Adobe Flash installer. Of course, you don't want to test that by installing it on a production Windows machine. But, if you have a Windows VM handy, you can test the malware on it. (Either make a snapshot of the VM before you begin or be prepared to trash the VM afterward.)

As I said at the beginning, malware analysis is quite an in-depth topic and there are lots of more sophisticated programs to use for it. However, if you have suspicions about something and need to just do a quick check, these two techniques might be all you need.

Next, let's look at how to automatically audit the system for different events.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.147.77.4