Reply to thread

Message

<blockquote data-quote="Adrian Ścibor" data-source="post: 1026168" data-attributes="member: 71496">From the point of view of static and dynamic analysis, a polymorphic file is still the same file, which is a copy of the previous one. So having, for example, 1000 original samples and adding a few bytes with some tool to change the SHA256, they are still the same files, so you have 2000 files in total. They do nothing malicious other than what they were originally programmed to do. Therefore, adding copies of the same files, I don&#039;t think is a good recommendation.Basically let&#039;s say for example: You have the file A.exe. Add a few bytes, add obfuscation, and you have file B.exe with a different checksum. You can upload to VirusTotal and check that first there was a detection rate of 40/60 and now it&#039;s 1/60 and you say - hey, antivirus sucks! What you don&#039;t actually know is that the engines on VirusTotal are usually not the same as the ones you have installed on your home or company PC:VT webpage quoting source: <a href="https://support.virustotal.com/hc/en-us/articles/115002094589-Why-do-not-you-include-statistics-comparing-antivirus-performance" target="_blank">https://support.virustotal.com/hc/en-us/articles/115002094589-Why-do-not-you-include-statistics-comparing-antivirus-performance</a>If you want to read more about VT engines usage, please read my analysis (sorry, in Polish only, please use machine translating): <a href="https://avlab.pl/dlaczego-virustotal-pokazuje-wyniki-skanowania-inne-niz-w-rzeczywistosci/" target="_blank">Dlaczego VirusTotal pokazuje wyniki skanowania inne niż w rzeczywistości? » AVLab.pl</a></blockquote>

[QUOTE="Adrian Ścibor, post: 1026168, member: 71496"] From the point of view of static and dynamic analysis, a polymorphic file is still the same file, which is a copy of the previous one. So having, for example, 1000 original samples and adding a few bytes with some tool to change the SHA256, they are still the same files, so you have 2000 files in total. They do nothing malicious other than what they were originally programmed to do. Therefore, adding copies of the same files, I don't think is a good recommendation. [B]Basically let's say for example: [/B] You have the file A.exe. Add a few bytes, add obfuscation, and you have file B.exe with a different checksum. [B]You can upload to VirusTotal and check that first there was a detection rate of 40/60 and now it's 1/60 and you say - hey, antivirus sucks! What you don't actually know is that the engines on VirusTotal are usually not the same as the ones you have installed on your home or company PC:[/B] VT webpage quoting source: [URL]https://support.virustotal.com/hc/en-us/articles/115002094589-Why-do-not-you-include-statistics-comparing-antivirus-performance[/URL] If you want to read more about VT engines usage, please read my analysis (sorry, in Polish only, please use machine translating): [URL='https://avlab.pl/dlaczego-virustotal-pokazuje-wyniki-skanowania-inne-niz-w-rzeczywistosci/']Dlaczego VirusTotal pokazuje wyniki skanowania inne niż w rzeczywistości? » AVLab.pl[/URL] [/QUOTE]

Verification