3 ms·

Ah, thanks! I glanced through and only saw AV1, AV2, etc. The paragraph above puts names to them, and at least some of those are indeed in VirusTotal. One thin

Ah, thanks! I glanced through and only saw AV1, AV2, etc. The paragraph above puts names to them, and at least some of those are indeed in VirusTotal. One thing I forgot to mention before: using hashes to identify malware is just not effective in the least Absolutely true, but VirusTotal is only using hashing to determine if it's already scanned a particular file (and even if it has, you can still force a re-scan). Most of the individual AV engines have at least basic heuristics, so, for example, you can detonate a piece of malware in a VM, dump the memory, carve out the offending module[1], upload it to VirusTotal, and still get a positive hit. 1. It may need to be remapped to virtual address order and PE-formatted. I've never tried it with raw pages.

daeken 14y ago
> Absolutely true, but VirusTotal is only using hashing to determine if it's already scanned a particular file (and even if it has, you can still force a re-scan). Most of the individual AV engines have at least basic heuristics, so, for example, you can detonate a piece of malware in a VM, dump the memory, carve out the offending module[1], upload it to VirusTotal, and still get a positive hit. I was referring to the method they currently use, which is just matching hashes, not VirusTotal. No matter what, you need to somehow run the code through an antivirus at some point, so the files need to go up to the server or you need to run the AV locally.