Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 714568">I did actually take a look at the test sample regardless of it being a test one and it does show a deceiving GUI. It also lacks PE details, isn&#039;t digitally signed, has no icon, etc... It checks many boxes for being at-least &quot;suspicious&quot;, so I&#039;d hope it&#039;d get flagged by an AV product, even if it truly isn&#039;t &quot;ransomware&quot;.The interface for the sample will claim that your file&#039;s are/will be encrypted and request payment, which of course is non-functional feature as it&#039;s a test sample. While nothing is actually going to be encrypted (there is not even support for enumeration of files - it&#039;s not even a fake simulation, it&#039;s literally just a UI with a timer), you could in theory claim that it should be marked as &quot;malicious software&quot; due to it&#039;s deceiving form. Obviously, the malicious was not intent because the intent was for it to be a test sample which would do absolutely no harm, but if someone were to share it around regardless, how would an average user feel coming confronted by it?To be precise, it&#039;s a MSIL executable which has a UI which meets a criteria to appear like in-the-wild ransomware would. It has a timer, dark background, a payment button, etc. There&#039;s no functionality other than the timer, but that&#039;s not the point. It could still scare an average user and put them into distress if they really believed it.Advanced users will know that it&#039;s a test sample and where it came from, but if someone starts trying to prank people and shares it around, an average unknowing user might not feel so good about the joke. It&#039;s Anti-Virus vendors jobs to protect people from malicious software as much as they can, therefore it only makes sense for them to flag it, even if no encryption capabilities are present - you could argue that there&#039;s no genuine use for the sample in a real-world environment because of it&#039;s interface and that is a reason to justify blocking it. It&#039;s also worth a mention that generic detection&#039;s are used to detect new malware which has not yet been seen (the actual sample - the variant may be known but the sample may be different) and there&#039;s many different forms of static heuristic analysis.On that note, the same detection names does not equal stealing detection&#039;s. Stealing detection&#039;s is when a vendor blatantly flags a sample because another vendor did, but there&#039;s actually no evidence what-so-ever here that any vendor which flags the sample did this, even if the detection name is similar/the same. As I&#039;ve already noted, the interface of the sample looks like what you could expect from ransomware in the home user market despite the lack of actual malicious code, and this could justify a detection.</blockquote>

[QUOTE="Deleted member 65228, post: 714568"] I did actually take a look at the test sample regardless of it being a test one and it does show a deceiving GUI. It also lacks PE details, isn't digitally signed, has no icon, etc... It checks many boxes for being at-least "suspicious", so I'd hope it'd get flagged by an AV product, even if it truly isn't "ransomware". The interface for the sample will claim that your file's are/will be encrypted and request payment, which of course is non-functional feature as it's a test sample. While nothing is actually going to be encrypted (there is not even support for enumeration of files - it's not even a fake simulation, it's literally just a UI with a timer), you could in theory claim that it should be marked as "malicious software" due to it's deceiving form. Obviously, the malicious was not intent because the intent was for it to be a test sample which would do absolutely no harm, but if someone were to share it around regardless, how would an average user feel coming confronted by it? To be precise, it's a MSIL executable which has a UI which meets a criteria to appear like in-the-wild ransomware would. It has a timer, dark background, a payment button, etc. There's no functionality other than the timer, but that's not the point. It could still scare an average user and put them into distress if they really believed it. Advanced users will know that it's a test sample and where it came from, but if someone starts trying to prank people and shares it around, an average unknowing user might not feel so good about the joke. It's Anti-Virus vendors jobs to protect people from malicious software as much as they can, therefore it only makes sense for them to flag it, even if no encryption capabilities are present - you could argue that there's no genuine use for the sample in a real-world environment because of it's interface and that is a reason to justify blocking it. It's also worth a mention that generic detection's are used to detect new malware which has not yet been seen (the actual sample - the variant may be known but the sample may be different) and there's many different forms of static heuristic analysis. On that note, the same detection names does not equal stealing detection's. Stealing detection's is when a vendor blatantly flags a sample because another vendor did, but there's actually no evidence what-so-ever here that any vendor which flags the sample did this, even if the detection name is similar/the same. As I've already noted, the interface of the sample looks like what you could expect from ransomware in the home user market despite the lack of actual malicious code, and this could justify a detection. [/QUOTE]

Verification