1

I have an exe installable which I want to do virus scan online before installing it (I do have a running AV but I am more cautious). Most online servers are limited to certain size (like 128MB for virustotal).

Can I split exe 240MB into 10 files and scan each file online? I can repeat this for different split sizes like 24MB, 12MB, 120MB etc. Does that achieve the objective of anti virus scanning (at least 99.9999% safe by split scanning)?

3
  • File checksum is one of a vital test for virality, splitting up the source execute practically make this test useless.
    – hkdtam
    May 13, 2016 at 5:02
  • And imagine you split the file in the middle of some known fingerprint for malware, then the scanner service won't be able to detect that.
    – zagrimsan
    May 18, 2016 at 7:45
  • Wont splitting with different sizes as mentioned in original question bypass this?
    – J J
    May 24, 2016 at 0:12

3 Answers 3

2

You mentioned it's an installer. It may work by self-extracting its content to a temporary folder and running extracted setup.exe or similar. If that's the case then you may be able to extract the files (and proper directory structure) to chosen destination with another (trusted) program (e.g. try 7-Zip on your exe). The resulting files will hopefully be small enough to scan them online one at a time.

Obviously this procedure will not detect a virus (if any) associated with extractor; it will only bypass it. If you decide to install, do it by running extracted setup.exe (or similarly named file).

1
  • If it is extractable setup.exe, I agree extract using 7-zip and scan individually. Question was around, if a virus is embedded in .exe regardless what wrappers you use then somehow AV detects those in exe and reports. So if I randomly split file with different file sizes, can AV capture embedded virus based on its algorithm.
    – J J
    May 14, 2016 at 4:54
1

My experience says that the best method to check if an executable has virus can be done by installing it.

If you have the time and effort, you can download VirtualBox for free, create a virtual machine, install anti virus and anti malware on it, copy the executable, disconnect it from your network and hit install.

Test for strange behavior.

After you are done, destroy the VM.

Check this step by step guide to create a virtual machine.

2
  • Not practicable, also time consuming. Some virus target certain time frame only and you cant test all miss-behaviours!
    – J J
    May 14, 2016 at 4:49
  • @JJ those kind of viruses will get caught by the anti-virus software that I mentioned to install on the VM. Time consuming? Yes. But not as much as getting rid of a virus from your PC
    – Divin3
    May 14, 2016 at 8:34
0

You can break up the exe into parts using curl and then try to scan individual ones as you have already thought of. But it depends on the exe itself and how it is encoded.

Most AVs work based on signatures and will check for them across the complete exe. If the executable is not encoded in any way then yes the splitting method might work.

But if it is encoded (as most modern viruses/malwares are) it might not be identified. So then the only alternative would be sandboxing or running it in a Virtual Machine.

2
  • signature of file(s) could be the first level of check by AVs. What if I take a known virus code, add some log statements and create another exe? Certainly sgnature wont be there in any AV history. But I guess somehow AV captures this? Not sure how.
    – J J
    May 14, 2016 at 4:51
  • It doesn't matter if you add more content into the exe, It's not the complete program's hash that is checked. Most modern anti-viruses look for known patterns of malware and virus code signatures. These signatures will still be present as a part of the main executable (unless it is encoded) May 14, 2016 at 10:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .