Reply to thread

Message: <blockquote data-quote="Andy Ful" data-source="post: 968953" data-attributes="member: 32260">The problem of corrupted files is more complex. These files can be a part of the larger attack (payloads) but simply require the initial loader or external resources (*.tmp, *.dll, *.dat, etc.). They cannot be executed alone, so they cannot be also detected dynamically in such tests. They can be detected when the attack is monitored starting from the initial malware and ending with the final payload. After detecting the full attack, the signatures of such payloads can be blacklisted as for standard malicious files.Post edited.</blockquote>

Top