Advice Request is this file malicious? [Update]

[fedor345]

hi i wanted to ask if this file is safe to use.

VirusTotal

VirusTotal

www.virustotal.com

 

[Bot]

The file appears to be malicious. It has been detected by multiple antivirus engines on VirusTotal. It's recommended not to download or use this file.

 

[fedor345]

The file appears to be malicious. It has been detected by multiple antivirus engines on VirusTotal. It's recommended not to download or use this file.

i see on virus total that its clean so im a bit confused

 

[Bot]

i see on virus total that its clean so im a bit confused

Apologies for the confusion. If VirusTotal shows that the file is clean, it's likely safe. However, no tool is 100% accurate. If you're unsure, it's best to err on the side of caution.

 

[roger_m]

hi i wanted to ask if this file is safe to use.

Yes it is. It was uploaded to VirusTotal in July of last year and in the following eleven months no antiviruses have added signatures for it.

 

[Parkinsond]

Yes it is. It was uploaded to VirusTotal in July of last year and in the following eleven months no antiviruses have added signatures for it.

There is no single detection for on VT! how to prove it is malicious?

Spoiler: VT

 

[roger_m]

There is no single detection for on VT! how to prove it is malicious?

Reread the original post. They asked if it was safe.

 

[fedor345]

There is no single detection for on VT! how to prove it is malicious?

Spoiler: VT

View attachment 289027

idk im not kinda into these things so i want to be extra careful. im worrked that if som virus isnt hidden somewhere inside bur its not detected on virus total

 

[Parkinsond]

No: for title
Yes: for body text

 

[Parkinsond]

idk im not kinda into these things so i want to be extra careful. im worrked that if som virus isnt hidden somewhere inside bur its not detected on virus total

I was once paranoid when I stopped my thyroid replacement therapy.

 

[fedor345]

No: for title
Yes: for body text

hope it is okay then. thanks for the reply

 

[Trident]

Malicious/safe, both of them are boolean. If it’s not one, it’s the other. Whatever they are asking, isMalicious=false, looksLikeSafe=true

 

[fedor345]

Malicious/safe, both of them are boolean. If it’s not one, it’s the other. Whatever they are asking, isMalicious=false, looksLikeSafe=true

okay thanks. maybe i will test it a bit on VM. but o hope that its clean

 

[Shadowra]

Before we start: Where did you download this file from?
Can you DM it to me for analysis?

 

[fedor345]

Before we start: Where did you download this file from?
Can you DM it to me for analysis?

yes ofc i can.
this is the site:Na stiahnutie | Softy.sk

below is the file proffesionally marked.

 

[roger_m]

Before we start: Where did you download this file from?
Can you DM it to me for analysis?

It can be downloaded from http://lizenzgold.de/Download/Microsoft/Office/Office%202024/EN_Office_Professional_Plus_2024_64Bit.exe, as well as other sources. It's a self extracting RAR file which contains an official Microsoft installer for Office and some configuration and batch files which when run, download and install Office Professional Plus.

 

[Shadowra]

yes ofc i can.
this is the site:Na stiahnutie | Softy.sk

below is the file proffesionally marked.

I'll examine it and send you my report

 

[Shadowra]

It's an Office 2024 installation file, but I have to admit that disguising it as an SFX file is a bit weird....

Spoiler: SFX

Once extracted, a .BAT file will open the installation, reading an XML configuration file (cracked program??)

Spoiler: Decompilate

The file itself isn't malicious, but downloading the original .EXE to a Google Drive reminds me of a cracked version of Office.
I wouldn't install it on my home PC.

 

[Parkinsond]

I have to admit that disguising it as an SFX file is a bit weird

SEP client is distributed in the same form.

 

[Shadowra]

SEP client is distributed in the same form.

True, but coming from a Microsoft programme, it's rather odd.

I see Office either as an .EXE with the installation logo, or as an ISO