2

I was wondering how safe is scanning a .zip file and depending on the AV report on what to do with it. So specifically: If I have a .zip file and I run a scan using a good antivirus and does not report a threat, is that re-assuring? If I know that the .zip file contains only non-exe files e.g. mp3 and mp4 and I extract the .zip and then scan each file individually and the antivirus does not report a threat is that reassuring? Is there anything to take into account in this cases?

3
  • It depends. There are plenty of 0 day exploits that will not be picked up by virus scanners
    – DavidPostill
    Aug 14 at 7:59
  • @DavidPostill: Are those exploits based on opening executables?
    – Jim
    Aug 14 at 16:48
  • 5
    @Jim how would anyone know? by definition, zero-days are unknown to the general public
    – mrbolichi
    Aug 14 at 18:06

3 Answers 3

10

ZIP doesn't change much. A competent AV program should report the same results for zipped and unzipped files.

Non-executable files will generally be less likely to contain malicious code because launching that code is much more difficult. With programs, scripts etc. you are executing some code by running that executable. In non-executable formats the attacker doesn't have this convenience and must find a way to trick the program reading the file (the player, document viewer etc.) into executing its contents instead of interpreting it. They have to find a bug in the program and a reliable way to exploit it. But different programs may use different file loading code, so the malicious file must be prepared with specific software in mind. This makes this kind of attack less practical.

That doesn't mean that non-executable formats are to be trusted. Such exploits in popular software are found every now and then. Some files also have non-obvious executable parts, eg. Word and Excel documents can contain executable macros. The fact that Word is so commonplace on Windows PCs and its files look benign makes it a very attractive vector.

It also doesn't mean that less popular, obscure programs are safer. They can use the same file parsing library as more popular software, along with its bugs, but will probably be updated less frequently with fixes and not battle-tested as thoroughly.

The bottom line is: don't open files from untrusted sources and make sure your automated backups are complete, up to date and restorable.

17
  • 1
    @Jim I'm not sure if Google is processing the files or serving them originally for previews. For example PDFs are processed, so it would be safer (it's Google opening the files, not you) but I don't know how other formats work there. If they do some conversion on the files, then they are taking the risk, not you.
    – gronostaj
    Aug 14 at 16:21
  • 1
    One way a ZIP file does change things is that there are a number of cases where a) a program will run executable scipts within a zip, and b) that program won't check if the extension is what you think it would require. Notable cases of this include the JVM. So files that look like they are not executable files, can in fact be exectuable files that a JVM will run. (I have constructed a file that looks like an image, but is also a an executable java program in the past) Aug 14 at 17:43
  • 1
    @Jim that's the case of non-executable file being constructed to exploit a bug in a particular piece of software. It's possible, but relatively rare and the potential attack surface is smaller because you have to target bugs in a specific program one could use to extract it. It may make more sense for targeted attacks, when attacker knows what software will be used to open the file.
    – gronostaj
    Aug 14 at 18:33
  • 1
    It gets more significant when you start considering more complex attack chains, just as using an image to get a file into a sandboxed part of the system, and then using a separate scripting attack to trigger running the jvm within that sandbox. Independently the two might be insignificant, but combined they present an issue. Zips are not an issue on their own, but these behaviours add a significant layer of complexity to the attack surface of a system, and can be mitigated by treating the zips as potential threats. Aug 14 at 23:13
  • 1
    @Downvoter, what is wrong with this answer? I'll be happy to improve it, but I don't know what needs improving. It's clearly not obvious looking at the vote balance. Just a downvote without any explanation isn't constructive in such case.
    – gronostaj
    Aug 15 at 5:42
9

After a scan by an antivirus of zipped or unzipped files, you can be sure that it doesn't contain any virus that is known to the antivirus program.

In other words, such a scan makes it a bit safer, but absolutely you are not safe, as antivirus programs are never perfect.

To be still safer, you could upload the file to virustotal, where it will be scanned by dozens of antivirus products. If all of them find nothing, you may safely decide that it's safe.

For still much more safety, install sandboxie and examine or execute the file from within a sandbox. You're then extremely well isolated from the real Windows, operating then only inside a virtual environment that you can wipe out with a click.

9
  • I am not familiar with virustotal. Is that trusted to upload files that end up being safe? I mean do they keep the files?
    – Jim
    Aug 14 at 10:07
  • What if I upload the zip to google drive and unzip there and preview the link from a different OS via google drive?
    – Jim
    Aug 14 at 10:08
  • 5
    Virustotal is trustworthy in the sense of being reliable and not manipulating the results, but it depends on reliability of AV vendors it uses and all files uploaded for scans are browsable for paying users.
    – gronostaj
    Aug 14 at 10:50
  • 1
    Very reliable - it hooks all pertinent API calls and isolates your program. It's kept my computer clean for years (and I do like to try new software).
    – harrymc
    Aug 14 at 12:47
  • 4
    @Jim The only reliable way is to reverse engineering it. Otherwise: 1) use VT to see if it is a known threat to any AV. 2) Use an online sandbox (e.g. triage, anyrun, joe sandbox) to check its behavior. 3) Use a virtual machine. I've analyzed malwares that tricked all of these. Sanboxie is particularly well known and easily detected, but most malwares just terminated in that case. A virtual machine is the most reliable method. If a malware escapes your hypervisor it means it was sent by a government actor. In that case, you lose in all scenarios. Escaping sandboxie is not easy either. Aug 14 at 18:39
4

I have decided to run practical test using EICAR test file. The version I used is padded to length 128 by spaces, otherwise the original text still stayed unmodified in the file when viewed in hex editor.

I have uploaded uncompressed and compressed version to virus total. In both cases most antiviruses detected a malware, but the detection rate have dropped from 57/66 to 49/63.

Following antiviruses failed to detect "malware" (ignoring those which were unable to process file or failed to detect even uncompressed file):

  • Ad-Aware
  • Alibaba1
  • ALYac
  • SUPERAntiSpyware
  • Symantec1
  • TACHYON

Unless your antivirus is in this list, then it is most likely that scanning compressed files is equal to scanning uncompressed files. But keep in mind that antiviruses will be unable to scan password protected archives, but there seems to be two exceptions to this. Antiviruses Cyren and Fortinet seem to be able to scan archives with ZipCrypto encryption and arbitrary password. All antiviruses are unable to scan archives with AES-256 encryption and even simple password (tested with 123456).


1 Those antiviruses were able to detect "malware" only after rescanning the file and also they weren't able to detect different archive with same content. This probably means they learned about the detections from other antiviruses and chose to report the file as virus too.

5
  • 1
    Given how easy it is to crack standard password-protected archives' encryption, I expect some antivirus programs to do so. It'd be interesting to see how many, though.
    – wizzwizz4
    Aug 15 at 16:33
  • 1
    May be I am reading the reports wrong, seems that Symantec does report it. I see it in a red row.
    – Jim
    Aug 15 at 17:19
  • @Jim Yes, I have rescanned the file and now two more antiviruses detect it. Also I have problems with getting consistent results now when I tried to recreate the file I previously tested with. I will update the post soon.
    – Jiří
    Aug 15 at 17:30
  • @wizzwizz4 I have added result of test with encrypted archive.
    – Jiří
    Aug 15 at 21:23
  • I think it's not as much copying other antiviruses' results, but rather submitting these samples for manual analysis
    – gronostaj
    Aug 16 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.