- [Instructor] In this Closer Look segment,
we're gonna focus on analyzing malware.
Now, I want you to imagine
that you're faced with a situation
where you suspect a file is malicious,
but the antivirus isn't tagging it as such.
What can you do?
Well, one option is to join
thousands of professionals around the world
who submit files for analysis.
And one of the most popular malware analysis services
is VirusTotal.
Now VirusTotal is owned by Chronicle,
which is a subsidiary of Alphabet
that we know better as Google.
Now, this is a really easy service to use.
If you wanna submit a file,
you can just browse for the file, and send it right up.
Now we're gonna submit a malware sample.
It's not really malware,
it's just made to look like it might be a malware file.
And let's see how it's detected.
So I'm gonna choose a file.
I'm gonna choose this AV Test file.
I'm gonna send it up,
and right away I have 41 engines
who have returned information about the file,
and they're coming back telling me
that it's an EICAR test file, that it's not a virus.
That's what most of them are telling me.
So what's an EICAR antivirus test file?
Well, the test file is a computer file
that was actually developed by
the European Institute for Computer Antivirus Research.
That's the EICAR,
and the Computer Antivirus Research Organization, CARO,
to test the response of computer AV programs.
So instead of using real malware,
which would cause, well, real damage,
this test file allows people
to test their antivirus software
without having to use a real computer virus.
In this case, these engines,
the majority of them all detected
that this was actually an EICAR test file.
We know very often when we're working with malware,
we don't actually wanna interact
with the actual malicious file, right?
We don't wanna copy it,
we don't wanna move it around,
we don't wanna install it.
So another way to get information
is to take a hash of the file
to create that representation,
and then send the hash up for analysis.
So let's do that next.
I'm coming over to search,
and I am pasting in a hash.
And what am I gonna get back?
Well, I'm told that 40 engines detected this file
as being malicious, based on the hash that I inputted.
You can see everything from suspicious,
to giving me information that it's a Trojan,
to giving me malicious scores,
to telling me that there's multiple detections.
I can see all of these various engines
that are coming back and giving me more information
related to that file.
Now, interestingly, they have different names,
and that's because different engines
and different antivirus publishers
and researchers actually assign different names
to the same piece of malware.
If I wanna get more information,
I can go to details, get that basic properties,
but also here I can look at history,
first submission, last submission, last analysis,
earliest contents modification,
latest contents modification.
I can find out if this file has been submitted
under any other names or any other hash sequences.
I can get more information about the file itself
and the certificates that are associated with it.
I can get relationship information.
Maybe this piece of malware
comes bundled with other pieces of malware.
I can learn about its behavior and its various mechanisms,
and if anyone who's in the VirusTotal community,
which anyone can join,
has a comment or more information about it,
well, I can read that as well.
And if I learn more about it,
I can submit it up through the community,
so I can share what I've learned with other people.
Now, perhaps you don't have malware on your system,
but you're concerned that you have users
potentially visiting a site
that might be a malware distribution site.
Well, another option is to input either
an IP address or a URL.
So I'm gonna add one right here.
I'm gonna do Alegroup.info and see what we can learn.
It comes back that five engines
detected this particular domain
and they come back and say malicious,
malware, suspicious, and phishing.
So that confirms my concerns.
Again, if I want more detail, it tells me the categories.
Sophos thinks it's a malware repository
of spyware and malware.
Forcepoint is telling me
that it has potentially unwanted software.
I can get some popularity ranks.
Here, I can get information about DNS records,
and certificate information.
I go relations, I can get information
about the IP addresses that this group has been used.
I can see what the various sub-domains are,
communicating files, referring files,
as well as Whois lookups.
And once again, if the community had any comments,
I'd be able to get my community comments there as well.
So this is a really interesting combination
of open source community and commercial vendors
all participating together.
I really, really recommend
that you become a member of the VirusTotal community.
It's free to join.
You can see the latest comments,
just lots of really good information
that comes out of here
that you can learn from.
And so importantly, if you have anything to add,
you can share it
with your fellow cybersecurity professionals,
and that, my friend, is a Closer Look.