Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 986377" data-attributes="member: 32260">[ATTACH=full]266224[/ATTACH]Avast: Files downloaded by the web browser are not checked automatically by the cloud backend until they are executed. The 16,49% detection is related to the local pre-execution features (mostly offline signatures). When the sample is executed, Avast triggers the cloud backend - the unrecognized &amp; suspicious EXE files downloaded via the web browser can be detonated in the cloud sandbox (Hardened Mode enabled). This can hardly miss any EXE sample downloaded directly via the web browser, except very rare samples with strong anti-sandbox features.Avira: The files downloaded via web browser are scanned by Avira Browser Safety (web browser extension, part of cloud backend) that could detect 76,49% of samples. The full cloud backend is triggered on file execution which improves the protection by 23,22%.The cloud backend does not include detonation in the cloud sandbox (available in Avira Prime).Comodo: Files downloaded by the web browser are not checked automatically by the cloud backend until they are executed. The 0.34% detection is probably related to offline signatures. The cloud backend is triggered on file execution. The execution is postponed until the analysis is finished. The files recognized as malicious are blocked, benign files are allowed, and unknown files are auto-sandboxed in the local Comodo Sandbox. This can hardly miss any EXE sample, except for rare samples that can escape the default sandbox (the default sandbox is not set to the strongest option).</blockquote>

[QUOTE="Andy Ful, post: 986377, member: 32260"] [ATTACH type="full" alt="1651237247598.png"]266224[/ATTACH] [B]Avast: [/B]Files downloaded by the web browser are not checked automatically by the cloud backend until they are executed. The 16,49% detection is related to the local pre-execution features (mostly offline signatures). When the sample is executed, Avast triggers the cloud backend - the unrecognized & suspicious EXE files downloaded via the web browser can be detonated in the cloud sandbox (Hardened Mode enabled). This can hardly miss any EXE sample downloaded directly via the web browser, except very rare samples with strong anti-sandbox features. [B]Avira:[/B] The files downloaded via web browser are scanned by Avira Browser Safety (web browser extension, part of cloud backend) that could detect 76,49% of samples. The full cloud backend is triggered on file execution which improves the protection by 23,22%. The cloud backend does not include detonation in the cloud sandbox (available in Avira Prime). [B]Comodo: [/B]Files downloaded by the web browser are not checked automatically by the cloud backend until they are executed. The 0.34% detection is probably related to offline signatures. The cloud backend is triggered on file execution. The execution is postponed until the analysis is finished. The files recognized as malicious are blocked, benign files are allowed, and unknown files are auto-sandboxed in the local Comodo Sandbox. This can hardly miss any EXE sample, except for rare samples that can escape the default sandbox (the default sandbox is not set to the strongest option). [/QUOTE]

Verification