Reply to thread

Message

<blockquote data-quote="struppigel" data-source="post: 938207" data-attributes="member: 86910">It really depends. A legitimate software can be abused by malware. E.g., legitimate remote access tools can be configured in a way that they get installed silently onto your system and are operated by someone else without your consent. So having a legitimate company behind a sample is not a sure way to exclude an infection. Furthermore, a legitimate software may also be part of a malware, e.g., browser password recovery tools are sometimes embedded into malicious stealers.Intezer compares characteristics of uploaded samples to others that they have already classified. They will pick up embedded legitimate files.I am not sure if they also check signers, but can imagine that they would. Legitimate software is often signed by the vendor, so that you can be sure it is really this company that produced the software. But that doesn&#039;t mean the file is clean.Can you provide a link to the run on Intezer?</blockquote>

[QUOTE="struppigel, post: 938207, member: 86910"] It really depends. A legitimate software can be abused by malware. E.g., legitimate remote access tools can be configured in a way that they get installed silently onto your system and are operated by someone else without your consent. So having a legitimate company behind a sample is not a sure way to exclude an infection. Furthermore, a legitimate software may also be part of a malware, e.g., browser password recovery tools are sometimes embedded into malicious stealers. Intezer compares characteristics of uploaded samples to others that they have already classified. They will pick up embedded legitimate files. I am not sure if they also check signers, but can imagine that they would. Legitimate software is often signed by the vendor, so that you can be sure it is really this company that produced the software. But that doesn't mean the file is clean. Can you provide a link to the run on Intezer? [/QUOTE]

Verification