2

I tested a file on VirusTotal and 10% of the feed back says it is bad. My question would be why didn't they all say it was a bad file? Why didn't the companies I recognize and trust say it was bad? Can I get some opinions on how a report like the one below might be interpreted? Are 10% simply wrong? conversely, are 90% wrong?

https://www.virustotal.com/#/file/c6bf8ec7f158734b5201e080bebcd37bc2553cc6588dda0d6f0bc2fbda07bf08/detection

1
  • 2
    Different companies use different methods to check for malware. They will all flag some good files as malware and will fail to flag some bad files as malware. The reason you would use VirusTotal is to see what the consensus opinion is. In this case, it seems that there is about a 10% chance that the file is bad.
    – Blackwood
    Sep 9, 2018 at 0:15

1 Answer 1

2

I will start with data from the referenced web page, which I refer to. (The columns were unlabeled, so I inserted the meanings based on what they looked like they referred to.)

AntiVirus Vendor: CAT-QuickHeal
Trojan.IGENERIC
Anti-Virus Software: Cyren
W32/GenBl.DEAF24C0!Olympus

AntiVirus Vendor: GData
Win32.Trojan.Agent.2OV2PC
Anti-Virus Software: Ikarus
Trojan.Win32.Agent

AntiVirus Vendor: Rising
Malware.Undefined!8.C (CLOUD)
Anti-Virus Software: TrendMicro-HouseCall
Suspicious_GEN.F47V0716

Once you find something is flagged, the next thing worth checking out is, "Why was it flagged?" So, start asking each one.

For CAT-QuickHeal's, it appears to label the softare as a Trojan (short for "Trojan Horse", named after the famous trap, and used in the Computer Security industry to refer to software that acts like it does one thing, but has a very sinister purpose). And, which family of Trojan Horses is it in? IGeneric. Maybe the I stands for Internet?

The W32/GenBl.DEAF24C0!Olympus looks more specific, so I used that as a search string.

Another generic site (meaning, not closely tied to just one vendor), CVEDetails, After going to CAT-QuickHeal's Ultimate Security Vulnerability Datasource, I searched for W32/GenBl.DEAF24C0!Olympus or other variations, but found nothing tell-tale.

The "DEAF24C0" is made up of entirely hexadecimal. At first, I thought that might be some sort of meaningful word, but after a while I started to think that was just a hexadecimal number (which just happens to start with the English word "Deaf"). I began to believe that much more when I noticed VirusTotal's "Details" tab shows an MD5 starting with deaf24c0. So deaf24c0 is the first 8 "digits" of an MD5 hash.

On the other hand, a Google Search for GenBL Olympus seemed to show several variants, and nobody seeming to know exactly what it does.

Moving on, we see that GData considers this to be a Win32 (Microsoft Windows 32-bit compatible platform) Trojan (program with fake intentions) Agent (software that runs in the background). That's a lot of generic-sounding phrases. The most specific, 2OV2PC, didn't turn up any search results.

TrendMicro's Threat Encyclopedia doesn't show anything for F47V0716.

We can also check out other details from VirtusTotal.

The Behavior tab from this file shows it creates some temporary files, executes code (a.k.a., starts a program) in a file that has a filename ending with .tmp (See: "Processes Created" section), and uses a bundled innocallback.dll

innocallback.dll suggests to me the usage of InnoSetup, a program that makes installers. This is also reinforced by going to the Details tab, of this search, and seeing a 76.6% involvement of "Inno Setup installer". The dDetails tab shows a comment of "This installation was built with Inno Setup."

So, based on all of the above, I reached a non-final conclusion (which I since changed my mind on) that this software seems like it is probably "safe", by my standards of "safe". Some anti-virus software might think this seems like "Adware", but I'm not particularly concerned if I end up seeing an advertisement. This could just be some software being concerned when an installer runs, since installers tend to do things like leave files behind, and possibly registering DLL files or other actions that require Administrative privileges.

However, I kept looking and then noticed some details that explain why I stopped trusting this program. These details were all found on the Details tab, of this search. I will start by just giving the details I found to be most interesting:

  • File Size 3.92 MB
  • Creation Time 2012-10-02 05:04:04
  • First Seen In The Wild 2010-11-20 23:29:33
  • Packers: F-PROT INNO, appended
  • Copyright FitGirl
  • Description Wolfenstein II Setup
  • Contained Resources: 9 Neutral, 5 Chinese Simplified, 3 US English

Okay, here are the reasons I'm seeing problematic aspects to this.

  1. First of all, why was the program seen in 2010 but reporting a creation time of 2012?

  2. The fact that it seems to have some Chinese components seems suspicious, unless there is some explanation. If this software was related to some sort of international commerce that involves China, that might make some sense. If this was a program just downloaded from the Internet, I'd be much more cautious. I'm open-minded enough to want to fairly give people around the world a chance, and I personally favor giving China business so we have compelling cause to maintain friendly ties with them, and I know that a bunch of stuff I use was manufactured in China. But despite all that, when I see China's involvement on the Internet, I've found that, more often than not, it's been related to some sort of cyber-attack, scam, or other highly undesirable thing.

  3. Perhaps most condemingly, it identifies itself as "Wolfenstein II Setup". Now, I happen to have been a gamer in the time when Castle Wolfenstein was sold. The sequel released in 1984, Beyond Castle Wolfenstein, looks like can be downloaded in about 52 KB-55 KB. If that's the case, why is this file close to 4,000 KB? Or, perhaps this was meant to be Return to Castle Wolfenstein, which was about 36,000 KB. Or perahps this was meant to be the newer Wolfenstein II: The New Colossus, released in the year 2017, which requires 27,000,000 KB of free space (NintendoLife: Wolfenstein 2). In none of these cases do a file size of 3.92MB make much sense, unless this includes an emulator or a downloader. In such cases, I would feel far more comfortable just downloading the useful files directly.

Also, why is this installer distributed by "FitGirl", instead of MUSE software, "id Software", Bethesda, or Activision? This does not sound like a software distributor involved in the original Wolfenstein software, nor any of the current major software companies that have been involved with a Wolfenstein name.

It looks like, best case scenario, you're likely looking at a file that infringes copyright. Especially if this file was intended for business use, that is widely seen as a severe no-no (even ignoring the idea that entertainment software may be considered inappropriate for many businesses). That's the best case scenario. If we aren't dealing with the best case scenario, then we're probably dealing with someone doing something misleading. In any case, I'm not finding it likely that this seems good/safe/recommended.

Now, to answer your question about different virus software reporting different things, this is simply known. A lot of what gets done during malware detection is based on previously identified and known problems, or best guesses based on software behavior.

Antivirus software is dead, says security expert at Symantec... “Information chief at Norton developer says software in general misses 55% of attacks”

Wired.com: Mikko Hypponen (of F-Secure): Why Antivirus Companies Like Mine Failed to Catch Flame and Stuxnet mentioned

“What this means is that all of us had missed detecting this malware for two years, or more. That's a spectacular failure for our company, and for the antivirus industry in general.”

“It wasn't the first time this has happened, either. Stuxnet went undetected for more than a year after it was unleashed in the wild, and was only discovered after an antivirus firm in Belarus was called in to look at machines in Iran”

“This story does not end with Flame. It's highly likely there are other similar attacks already underway that we haven't detected yet. Put simply, attacks like these work.”

“Flame was a failure for the antivirus industry. We really should have been able to do better. But we didn't. We were out of our league, in our own game.”

So, understand that while these software products try to provide peace of mind, the reality is that they are not foolproof.

1
  • You are correct on every doubt i can confirm you doubt is correct. And can say good show man! It is a FitGirl redistribution of a copyright infringing game of 2017s Wolfenstein II a 60GB game, for which this is the installer. Don't judge me, you don't know my reasons. And the chinese i suspect would be 3Dm related, the infamous chinese game cracker who breaks Denuvo frequently, supplying FitGirl with his RePack. And of course to answer my real question, which you did. Majority rules, trust your brand names, not everyone is right all the time. Go with the flow!
    – Xabache
    Sep 11, 2018 at 6:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .