Reply to thread

Message

<blockquote data-quote="ForgottenSeer 89360" data-source="post: 914267">It covers scripts, screensaver files and dynamic link libraries amongst others, but the MOTW is required. If it has been in an archive and it&#039;s been extracted through Explorer and not a 3-rd party archiver, the MOTW apparently gets preserved, as the file shown in my post was originally archived.Considering their testing kit downloads everything from the web, as stated in their methodology, then they all fulfil the CyberCapture requirements.It&#039;s possible that they count something as compromised before the CyberCapture verdict is available. That goes for Microsoft too.These results, apart from showing randomness and minimal difference, might not even be accurate.There will be no payload to download, when the original executable is held, until it&#039;s been automatically analysed and after the analyses, the payload would be already known to Avast. The presence of the downloaded file might be counted as a &quot;miss&quot; by a toolkit, that can&#039;t be smart enough to recognise CyberCapture alert. The way to bypass CyberCapture is with weponised documents, but I don&#039;t believe their bot can open an MS-Office document, then click &quot;Enable Editing&quot; on top and then &quot;Allow Content&quot;. It&#039;s most likely tested only against exes, bat files and ps1 files. This is where all these brilliant results come from.</blockquote>

[QUOTE="ForgottenSeer 89360, post: 914267"] It covers scripts, screensaver files and dynamic link libraries amongst others, but the MOTW is required. If it has been in an archive and it's been extracted through Explorer and not a 3-rd party archiver, the MOTW apparently gets preserved, as the file shown in my post was originally archived. Considering their testing kit downloads everything from the web, as stated in their methodology, then they all fulfil the CyberCapture requirements. It's possible that they count something as compromised before the CyberCapture verdict is available. That goes for Microsoft too. These results, apart from showing randomness and minimal difference, might not even be accurate. There will be no payload to download, when the original executable is held, until it's been automatically analysed and after the analyses, the payload would be already known to Avast. The presence of the downloaded file might be counted as a "miss" by a toolkit, that can't be smart enough to recognise CyberCapture alert. The way to bypass CyberCapture is with weponised documents, but I don't believe their bot can open an MS-Office document, then click "Enable Editing" on top and then "Allow Content". It's most likely tested only against exes, bat files and ps1 files. This is where all these brilliant results come from. [/QUOTE]

Verification