Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 995927" data-attributes="member: 62850">Yeah, depending on which malware repository it comes from, there are usually tons of invalid, duplicates and safe files mixed in with the real malware.&nbsp; This skews the results in a very big way.&nbsp; The invalid files will never execute, so they need to be excluded completely.&nbsp; The duplicates should be removed because if, for example, you have a malware pack with 100 samples, and 10 of them are dups, then the results are skewed by 10%... especially if the dup is a safe file <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" />.&nbsp; And the safe files need to be removed as well, for obvious reasons.&nbsp; I think what I will do is add some features in VoodooAi Desktop to remove the duplicates.&nbsp; The invalid files are already sorted automatically if your malware pack is located on your desktop.&nbsp; The reason the sorting is limited to the desktop is because we did not want a user to analyze the Windows directory and have VoodooAi Desktop move the Windows files to the sorted directories.As they say, that is not a bug, it is a feature <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" />.&nbsp; I actually added that feature and I cannot remember why at the moment, but I will play around with it and if it is possible to click on the item before the analysis is complete then I will remove that feature <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" />.Yeah, if you see a 404 error that means the sample has not been uploaded to VT yet.&nbsp; What we might do is make it so when the user right clicks on an item, it will take them directly to the file so they can manually upload the file to VT and to WLC.&nbsp; If WLC says the file is safe, you can be almost 100% certain that it is safe, especially if the VT results are safe as well.There is a limit to how many files can be analyzed with VT without having to respond to Captchas, so I just made it do one at a time.&nbsp; Thank you!</blockquote>

[QUOTE="danb, post: 995927, member: 62850"] Yeah, depending on which malware repository it comes from, there are usually tons of invalid, duplicates and safe files mixed in with the real malware. This skews the results in a very big way. The invalid files will never execute, so they need to be excluded completely. The duplicates should be removed because if, for example, you have a malware pack with 100 samples, and 10 of them are dups, then the results are skewed by 10%... especially if the dup is a safe file ;). And the safe files need to be removed as well, for obvious reasons. I think what I will do is add some features in VoodooAi Desktop to remove the duplicates. The invalid files are already sorted automatically if your malware pack is located on your desktop. The reason the sorting is limited to the desktop is because we did not want a user to analyze the Windows directory and have VoodooAi Desktop move the Windows files to the sorted directories. As they say, that is not a bug, it is a feature ;). I actually added that feature and I cannot remember why at the moment, but I will play around with it and if it is possible to click on the item before the analysis is complete then I will remove that feature ;). Yeah, if you see a 404 error that means the sample has not been uploaded to VT yet. What we might do is make it so when the user right clicks on an item, it will take them directly to the file so they can manually upload the file to VT and to WLC. If WLC says the file is safe, you can be almost 100% certain that it is safe, especially if the VT results are safe as well. There is a limit to how many files can be analyzed with VT without having to respond to Captchas, so I just made it do one at a time. Thank you! [/QUOTE]

Verification