Reply to thread

Message: <blockquote data-quote="Andy Ful" data-source="post: 1114536" data-attributes="member: 32260"><p>Most of the top AVs consider this sample as unharmful (Avast, Bitdefender, Kaspersky, McAfee, Sophos, Zone Alarm). This happens when the rare sample is already inactive when submitted for the first time to analysis. It could be an initial part of attack and malicious actions were done in the wild by another file (usually downloaded from the Internet), that was removed from the attacker's server before file submission. So most AVs cannot detect malicious actions because there are none. Eset and a few other AVs could see that sample when it was active, and detected malicious actions of downloaded payload. Of course, it can also be a false positive.</p></blockquote><p></p>

Top