Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 961294" data-attributes="member: 62850">Yeah, later on I came to the realization that the malware analysis machines / sandboxes often fail to return the correct verdict because when they launch the malware to start the test, if any dependencies are missing, the file will not execute and so the malicious code will not execute.&nbsp; But that does not mean the file itself is not malicious.&nbsp; If the dependencies are available in a real world attack, then the system will be infected.&nbsp; I mean sandboxes are okay, but they are not foolproof, especially when the malware has anti-sandboxing capabilities.&nbsp; But yeah, I had totally forgotten about that.&nbsp; I manually analyzed hundreds of files over 3 or so days and slept like 3 hours a night.&nbsp; Wait, that is pretty much what I have been doing now <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" />.Yeah, I totally agree, Ondrej is a great guy and super smart, and actually they were all great guys.&nbsp; You know someone is smart when they will take the time to listen to new ideas and new ways of doing things instead of acting like they already have all of the answers.It would actually be super easy to implement dynamic security postures into any existing software.&nbsp; It took me 10 years to get it to that point, but it is super easy now.&nbsp; It only took like an hour to implement dynamic security postures (automatic toggling) into DefenderUI Pro.</blockquote>

[QUOTE="danb, post: 961294, member: 62850"] Yeah, later on I came to the realization that the malware analysis machines / sandboxes often fail to return the correct verdict because when they launch the malware to start the test, if any dependencies are missing, the file will not execute and so the malicious code will not execute. But that does not mean the file itself is not malicious. If the dependencies are available in a real world attack, then the system will be infected. I mean sandboxes are okay, but they are not foolproof, especially when the malware has anti-sandboxing capabilities. But yeah, I had totally forgotten about that. I manually analyzed hundreds of files over 3 or so days and slept like 3 hours a night. Wait, that is pretty much what I have been doing now ;). Yeah, I totally agree, Ondrej is a great guy and super smart, and actually they were all great guys. You know someone is smart when they will take the time to listen to new ideas and new ways of doing things instead of acting like they already have all of the answers. It would actually be super easy to implement dynamic security postures into any existing software. It took me 10 years to get it to that point, but it is super easy now. It only took like an hour to implement dynamic security postures (automatic toggling) into DefenderUI Pro. [/QUOTE]

Verification