0

Somebody shared an exe file in a Telegram group. Let's just say the people that shared it do not know where it originated from but the software does what it should do. My concern is that it does something else in the background.

After some reading, I found that a safe way it to open it in a virtual machine and use a software like Process Monitor to monitor its activities.

Another way is to use a software debugger like x64dbg, but then I'll have to learn Assembly and seemed way too advance.

I am wondering if there is any other way that is more efficient in verifying the safety of an exe file.

6
  • No. Its extremely difficult (arguably impossible on any non-trivual exe) to ensure an executable is not malucious. Tangenial - look at the obfusicated c code challenges and research Stuxnet for an insite into some of the challenges.
    – davidgo
    Sep 30, 2022 at 2:20
  • Also not an answer, but getting various checksums of the exe and googling those very occassionally might help speak to the integrity of the software.
    – davidgo
    Sep 30, 2022 at 2:22
  • A virtual machine is not safe, but is a good way to limit the blast radius
    – davidgo
    Sep 30, 2022 at 2:23
  • 1
    Uploading the file to Virus Total is also useful for "low value" payloads.
    – davidgo
    Sep 30, 2022 at 2:25
  • 1
    “Somebody shared an exe file in a Telegram group. Let's just say the people that shared it do not know where it originated from but the software does what it should do.” What do you think you would get from this file if it is not infected? In general, just delete the file. Better be safe than sorry. Sep 30, 2022 at 4:39

1 Answer 1

3

Please don't even think about analyzing this file for safety. Save yourself. You don't analyze a .EXE file for safety. You analyze the trustworthiness of the source of the file. In this instance, the people who shared the file don't know where it came from. Problem solved, the .EXE is unsafe and should be treated as malware. There's no way to evaluate the trustworthiness of the source, so the source must be assumed to be dangerous.

Analyzing the contents of an executable file seems way to advanced and difficult because it is. There's people who do this sort of thing for a living (malware analysts), and they get paid very beefy sums of money for doing so (~$88,600/yr according to ZipRecruiter). Not only would you need to know Assembly, you'd also have to have in-depth knowledge of the guts of Windows, possibly knowledge about how other applications on the system work if the .EXE interacts with them, as well as an understanding of how software vulnerabilities work in the first place so that you can spot things like code hidden in data awaiting to be dropped as a payload. And this is just what I can think of off the top of my head - the list probably is longer.

If you could dissect the entire application and all of its supporting files, map out everything it does in detail, and ensure that every single possible (and maybe even impossible) code path is of no risk, then you might be able to verify that the executable was safe. But considering how difficult that is even when you have the source code of an application, it's much more likely to be exponentially trickier when you have nothing but the machine code to work with. And if you made a single slip-up, the malicious activity might still slip past you after your in-depth analysis.

Even if you put the application in a virtual machine or sandbox and then monitored it, there's no guarantee that it would be safe. A virus could easily remain mostly or entirely dormant until a specific date and then spring into action all at once - in fact, the ancient MacMag virus did exactly this. Or how about the Michelangelo Virus, which stays dormant for an entire year before wreaking utter havoc on March 6. Imagine if the .EXE had a virus like that, and you installed it into a VM and watched it do nothing harmful for months, then moved it to your physical system and then watched it proceed to delete or ransomware all your files. Could happen. With malicious software, the possibilities are endless.

Another reason virtual machines are a bad idea for verifying the safety of an executable is that many advanced malware systems are designed to detect if they are running in a virtual machine. If they detect it, they exhibit different behavior than normal. They may go totally dormant or delete themselves to complicate matters for a malware analyst, or perhaps they will download a different payload than normal so as to confuse a malware analyst. Again, even if it looks safe in a VM, it's quite possible for it to still be malicious.

Passing the file through an antivirus isn't enough either. Antiviruses can only detect malware that they already know about (and depending on the behavior of the virus or the way the malware author embedded it into the program, they might not even be able to do that). If an antivirus warns that a file is infected, that's a very good indicator that it's dangerous, but if it doesn't detect anything in the file, it is still quite possible that the file is not safe.

Unless you're a trained malware analyst with a TON of spare time on your hands, don't risk it. If you don't know where it's from, assume it just came out of the lab of an expert black hat who wants to take over the world. (E.g., delete it, don't ever run it.) At this point, if I were your friends, I would be changing all my passwords to all online accounts, backing up my important data, and reinstalling Windows, if I had run the mysterious executable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .