How to Tell if a File is Malicious

These days the internet is awash with malware. You can never be certain that the file you just downloaded isn’t some malicious file pretending to be safe. In fact many malicious files are designed to do exactly this. They try to trick you into running them so that they can go about whatever nefarious purpose they were designed for. This article will explain how to tell the difference between a safe file and a dangerous one. Although this may seem like a very daunting task, I do promise that it’s not too difficult. These days there are many very sophisticated, and simple, online services that allow you to make sure a file is not malicious. One method is given in step 1. If you believe that the file is probably safe then make sure that you read that section first before you continue on to the second section. It may save you a lot of time.

Index

1. Shortcut (If you believe the file is safe)
2. Check File Using Comodo Valkyrie
3. Check File Using VirusTotal
4. Check File For Malicious Behavior

1. Shortcut (If you believe the file is safe)

If you believe that the file in question is probably safe then it may not be necessary to go through the rest of the steps. First upload the file to Comodo Valkyrie. This is a free service provided by Comodo that allows users to upload files up to 20MB to be analyzed almost instantly. After uploading the file look at the upper left corner. There is a part that says "SHA1". Please copy the entire string of letters and numbers that are next to it. Now go to Comodo File Intelligence and change the search box from "Search by Filename" to "Search by SHA1". Then post in what you copied and click "Search Now". Look at the information it provides. If it says that "The file is safe" then quickly look at the results from Comodo Valkyrie. If the Final Result from Comodo Valkyrie says that the file is Safe or Unknown then you can trust the file. You do not need to continue on to the rest of the steps. However, if Comodo Valkyrie says that the file is Malicious then you will want to continue to part 2 of this article.

If, however, the file is found to be something other than safe by Comodo File Intelligence, then you should submit the program, or individual file, to Comodo for analysis. Instructions for how to submit programs, or individual programs, can be found in this topic of the Comodo forums. Make sure that you read through the first post entirely. Do not post files directly. Only post download links for them if you are sure that the program is safe. Otherwise post links to the scanning results, as explained in the post. These submissions will be quickly analyzed by Comodo staff and, if appropriate, added to the whitelist. All you need to do is keep an eye out for Comodo's response in that same topic about whether your submission was whitelisted or not. In most cases this shouldn't take more than a few days for programs. However, individual files can take anywhere from a few days to a few weeks, depending on how much information you provide and how many other requests they are trying to fulfill. The requirements for a file, or program, to be whitelisted are strict. Thus if the file is whitelisted you can be absolutely sure that the file is safe.

However, in order to submit programs you do need to have an account on the Comodo forums. If you don't already have one then it's very easy to get one. There is an option to register on the top of any page on the Comodo forums. Reporting a file in this method will not only allow you to find out for certain if it's safe but it will also help to make every Comodo product more usable.

2. Check File Using Comodo Valkyrie

Comodo Valkyrie is a free service provided by Comodo that allows users to upload files up to 20MB to be analyzed almost instantly. The link for Comodo Valkyrie is given in the title for the section. Just go to the site and browse to the file you're investigating. Then upload the file. These files will be checked by multiple types of detection including static detection, behavioral anaysis, whether it is detected by Comodo Antivirus, and advanced heuristics .

Using these detectors this service is able to provide a prediction as to whether the file is “Normal”, “Unknown”, or “Malicious”. A verdict of “Normal” means that the file is safe. “Malicious” means that it’s dangerous. If the analysis finds the file to be “Unknown” this means that it’s not sure.

One way to use Valkyrie to assess a file is to submit it to Comodo staff for analysis. This method is also the most certain. At the top of the page it shows pictures of the analysts you can assign the file to. To do this first make sure that you have an account with Comodo Valkyrie, and are signed in. If you don't already have an account, then it's very easy to get one. Simply go to "Sign Up", choose a UserName, give them a valid email address, and enter a password. All of your information is completely safe and you will, of course, receive no spam.

After assiging the file to the analyst they will manually analyze it and present you with the verdict. If they say the file is "Normal" then you know for sure that the file is safe. If they find it to be "Unknown" or "Malicious" then I'd advise getting rid of the file.  I wouldn't trust it. Having them manually analyze a file is the only way to be absolutely certain that it’s safe. This analysis should take less than 24 hours. If you do decide to have the file manually analyzed then you don't need to worry about any other methods discussed in the rest of the article. Just submit the file and wait for the results. However, if you want to find out more about the file, and aren't willing to wait for the manual verdict, then the rest of this article should be very useful for you.

If you decide not to wait for the analysis then you can also use this service to quickly get a lot of information about the file. After the file is analyzed the most important parts to look at are the "Auto Result" and the "Final Result". Both results are given at the top of the page. The "Auto Result" will give you the overall result from the static detection". The "Final Result" combigns the results from all types of detection to provide an overall prediction for the safety of the file. All services are discussed in greater detail below. If both of these give a verdict of normal then the file is probably safe. However, before looking at these overall results check the tabs for "Dynamic Detection and "Advanced Heuristics" tab to make sure that they have finished analyzing. This will take longer than the static detection. However, to get an even better idea if the file is truly safe then you will also want to look more closely at the individual results for each tab.

After the file is analyzed you will be presented with three different tabs of information. The first is called “Static Detection”. The tab shows the verdict of the 17 different AI detectors that checked the file. The individual verdict of these detectors is not important. Comodo uses a very sophisticated algorithm to determine the final verdict based on each of these detectors. What’s important is the overall result given at the bottom of the screen. This gives the automatic verdict in the box under where it says “Static Verdict Combination”. It also gives it's confidence under “Probability of Static Verdict”.

The other tab we will be looking at is called “Advanced Heuristics”. This examines the file with more sensitive algorithms. These are more likely to catch malware but are also more likely to incorrectly identify a file as “Unknown” or “Malicious”. Please keep this in mind when interpreting these results.

3. Check File Using VirusTotal

You can also find out whether any antiviruses (AV’s) detect it. One of the best sites for this is VirusTotal. A link to the service is given in the title of this section. This will scan any file you upload with over 40 different products and show the results separately for each one. You can upload files up to 32MB in size and the entire process should only take about a minute. This time largely depends on how long it takes to upload the file.

The most difficult part of using VirusTotal is interpreting the results. It can sometimes be difficult to tell from the results whether a file is likely to be dangerous. In general, if a significant number of scanners show a warning the file is likely to be dangerous. However, even if only a few detect it that does not necessarily mean that it is safe. Below are example findings for two files that are indeed malicious.

Using VirusTotal does have a few drawbacks. One of these is that it is certainly possible for malware to be so new that not a single antivirus yet detects it. Thus even if VirusTotal says that no AV detects a file it does not mean that it is not dangerous. I’ve seen this type of behavior on multiple occasions. A related problem is that malware is being created so quickly that antivirus companies are forced to use heuristic detections and generic signatures in an attempt to keep up with it. The problem with this approach is that these detection methods may incorrectly identify a legitimate file as malicious. This is know as a false positive. These types of mistakes do occur, and with increasing frequency. Thus, if only a few AV’s detect a file with heuristics, and the other AV’s do not, then this may be a false positive. However, this does not guarantee that it is. It's for reasons such as this that you should always check a file using all three methods discussed in this article. Below are example findings for legitimate files that are being incorrectly identified as dangerous by VirusTotal.

I want to be clear that even if only a single antivirus, or even none, detects a file as malicious then the file can still be dangerous. VirusTotal cannot be used to guarantee that a file is safe. However, if a very large number of antiviruses find the file to be malicious, then it likely is. This is the true strength of VirusTotal.

4. Check File For Malicious Behavior

In addition to the above methods you may also want to check the file for malicious behavior. There are many great services that can do this, but I have selected the two that I would most highly recommend. Do remember that legitimate files can be flagged as suspicious by them and that it’s also possible for malware to slip through undetected. In fact, some malware is even able to tell that it’s running in a virtual environment and thus refuse to run. It's for this reason, again, that it's best to use all three methods discussed in this article to analyze a file.

A) Use Comodo Instant Malware Analysis (CIMA)

A link to CIMA is given in the above title. The results of this service should be understandable by all types of users. You can upload files of any size to it and, after the upload is complete, it will immediately begin analyzing the file. The amount of time this takes is largely dependent on the size of the file and the complexity of its behavior. That said, in most cases it’s actually quite fast to analyze. I’d highly recommend using this service as it's very effective at recognizing suspicious behavior. Once the analysis is complete the results will be given at the end of the report. 

The verdict may be “Suspicious”, “Suspicious+”, or “Suspicious++”. If the verdict is any of these then possibly malicious behavior was detected. It also gives the reasons it flagged it as such immediately below the verdict. “Suspicious++” indicates the most suspicious behavior.

If it instead says that the “Auto Analysis Verdict” is “Undetected” then it did not find any suspicious activity. This doesn't guarantee that it's not dangerous, but it does make it more likely that it's not. Thus if the above steps didn't find any malicious behavior, and neither did CIMA, then you can be relatively certain that the file is safe.

B) Use Anubis

More advanced users may also wish to use Anubis. The link to this service is given in the above title. This is another highly effective behavioral analysis service. However, uploading files often takes a very long time and the results are more difficult to interpret. That said, this service does provide a lot of information about the behavior of the file and will serve as a great second opinion to CIMA. If you're an advanced user then I'd also highly recommend checking files with Anubis.