3 ms·
If you are a paid subscriber you get extra bits from VirusTotal. One of which is you can see what files are "parents" of the sample. In this case, there are a
by jdsnape 6y ago
If you are a paid subscriber you get extra bits from VirusTotal.
One of which is you can see what files are "parents" of the sample. In this case, there are a bunch of zip files that contain this file, all named Immunity Canvas or similar. Canvas is a pentesting tool where they publish exploits, so I guess he's saying you can attribute it to Immunity.
And yes, VirusTotal lets you download the file if you pay. It's the foundation of the "threat-intelligence" industry :)
- hannob 6y agoOh this is interesting context. I remember Immunity advertising about an exploit for spectre they have, and it's easy to find: https://twitter.com/immunityinc/status/959155986098421760 https://twitter.com/immunityinc/status/959155986098421760 Very likely that this is what the top poster found.
- jdsnape 6y agonice, I hadn't spotted that. Not much to go on in the screenshot but what is there looks similar to the sample in the linked article
- oauea 6y ago> And yes, VirusTotal lets you download the file if you pay Indeed, so it is critical to never upload any binaries to them that you do not have full permission to redistribute. Nowadays they are very open about the sharing, but in the past this was kind of hidden.
- justinclift 6y agoSounds like the RIAA or similar would still be all over them, if they become aware of the practice. Not sure if that's good, bad, or something else, though. :)
- salawat 6y agoThey're free to download and execute any files... Just to be sure.