[Doz1]

Lets say someone sends me an executable file, how can I make sure it's not malware?
I'm pretty sure just because my AV or a website like VirusTotal says it's 100% clean, doesn't mean it really is.
What steps or things would I need to do to make sure it's not malware or something?

[Doz1]

Upload it on Anubis and analyze the results. It will tell you (or at least, give you hints) of if the file is malicious or not.

http://anubis.iseclab.org/

So, that's it? If there's nothing suspicious in Anubis, does that mean it's clean?

[Doz1]

You can also run it via sandboxie or on a virtual machine and see what happens when you run the .exe there. Through either of those, you are running it in an isolated environment.

Yeah, but what if the .exe works as expected?
I just want to know the methods/steps a white hat or any malware checker would do to analyze it properly, to make sure it's 100% clean.

[John_Gacy]

I trust Anubis and Sandboxie usually gets the job done, but I would be interested too if there was any other methods excluding Virustotal and what not.

[Doz1]

I trust Anubis and Sandboxie usually gets the job done, but I would be interested too if there was any other methods excluding Virustotal and what not.

Yeah, it probably does get the job done against simple viruses/malware.
But what about actual hidden viruses, like let's say some knowledgeable torrent uploader where all his programs get thousands of seeders.

Maybe there's a line of code in one of his programs that stealthy downloads and executes a malicious file on your computer days after using the program. What then?

[Doz1]

If you're wanting to learn the way of a White hat then you should always be prepared by having a Firewall implemented as your security defense line. Firewalls will block any malicious or harmful content that your computer system encounters. I personally use Comodo Firewall-- Works like a charm. Consider on installing a firewall mate, they'll due the job. Instead of having to upload it to Sandboxie or Virtual machine, your firewall can just block what ever seems to be a threat.

No, I'm wondering what someone would do to properly analyze a file to make sure it's 100% clean.
I just said white hat because I don't know what else to call a malware 'analyzer'.

[Doz1]

http://anubis.iseclab.org/ would be appropriate for scanning the files before you go ahead and execute them. And Comodo Firewall allows you to scan files as well. If you choice, you can always use a Virtual machine or sandboxie.

Sorry, but I need a proper reply from some software engineer or something.

What if Anubis or those tools didn't exist? Are you saying just because it's clean on Anubis, means it really is?
The file could be safe at first, but then 2 hours later it's hard-coded to download a malicious file on your computer and execute it.

Anubis only shows what runs/executes when they start the file.

[Doz1]

Lmao-- What you're not getting is that these file scanners like Anubis are meant to analyze the file in depth. And if you were to get a firewall, you wouldn't have to worry about anything like that ever happening-- The firewall will block it right away if it was Malicious.

If you're that paranoid then I'd say just run the file through Sandboxie or Virtual machine.

What file/program are you trying to see if it's safe or not?

Okay, but are those the only things you'd do to make sure it's 100% clean?
So far all I've heard on these forums - VirusTotal+Anubis+Sandbox it.
I mean there has to be more, what would a computer scientist working for the FBI do?

I'm sure he wouldn't just go on Anubis, scan it and run it in a VM. There has to be more. I'm assuming he'd reverse engineer the file, but what else?

[Doz1]

Okay, cut the trolling right here. Do you REALLY expect us to know how the FBI forensics analyze a malware and a virus ? Let's be honest, NO ONE knows here what they do. This forum isn't the FBI lab or the NSA lab, it's mostly a hacking forum. This section is meant for people who want to learn how to protect their computer for everyday use, not how to analyze files like people in CSI. Sorry if my answer is rough, but I think you're asking a little too much here or you don't really understand what this forum is.

Sorry, I just expected people here to be smarter when it comes to stuff like this.
You'd expect certain people with 10k+ posts that spend years on a hacking forums, would know a little more than just saying use Anubis+Sandboxie.

I'm not asking for the exact steps the police does, just a brief explanation on how to properly analyze a file without these public tools.

[Doz1]

I'll tell you something : post count, Rep, prestige, award, it means nothing on HackForums. Even if someone have 10k posts here, what tells you there's not 9,999 posts in the Gaming area and 1 post here ? And most people here are kids aged between 14-16 years, so even if they were spending "years" on a "hacking" forum, it doesn't mean they have the knowledge to know how to analyse a file like a FBI forensics.
If you want a Security Software Engineer to explain you step by step how to analyze a file, then you should go in the Reverse Engineering and File Disassembling section. There people will tell you exactly how to analyze a file. But you'll have to know a programming language or even more to analyze the code, that's for sure.

Yeah, I'll just PM a friend.
Thanks for the help, anyways.