I need to know how anti-virus programs catch malware. Do they do it with hash numbers or not?

closed as too broad by perror, usr2564301, ixje, jvoisin, asheeshr Mar 29 '14 at 5:06



The most typical methods to detect a malware are the following:

  1. Streams of bytes. As simple as it sounds: find some specific string(s) or stream of bytes.
  2. Hashes. Either CRCs or similar to CRC hashes applied to some block of bytes like a section's data inside an executable file (i.e., a PE or ELF file) or the entry point. Each AV engine uses a different "CRC like" set of hashes.
  3. Generic detections and heuristics. Code, typically C or C++, that finds evidences and after a number of evidences it's considered "malicious". Some evidences, talking about executable files, can be some specific instructions at the entry point, the number and name of sections in the executable, where the entry point is (i.e., if it's in the last section, etc...), the compilation time-stamp, the imported libraries and functions, the entropy of the file or the entropy of some section inside an executable file, etc...
  4. Cryptographic hashes. A long list of MD5 or SHA1 hashes for specific malware samples. A very bad approach, BTW.

Other techniques:

  1. Graph hashes. A hash generated out of the call graph of the program or out of the flow graph of some specific function.
  2. Behaviour based heuristics. When a program executes a number of specific actions an AV engine can consider that the actions correspond to the actions of some specific malware. The behaviour, depending on the quality of each AV engine, can be get without actually executing the file but emulating it with the AV's emulator (x86, ARM, AMD64, JavaScript, ActionScript, etc...)

Those are the most common techniques used to detect malware by antivirus products.

  • 1
    Thank you, it´s very helpful. But, I have a sample of malware. I get it on virustotal.com and check results. If I modify the code - I´m only add NOP instruction after INT 2D instruction. Then, virustotal results are different, the many of AVs not detect as dangerous. Why? – zajko007 Mar 27 '14 at 10:49
  • 3
    You probably broke the PE file you're playing with. Anyway, I'm not going to help you evading AVs. – joxeankoret Mar 27 '14 at 10:59
  • 1
    @zajko007 - You are describing one of the ways in which malware writers evade detection. Defenders use signatures to detect malware, and attackers change the signature to evade detection. That way the same virus can be easily re-introduced to the wild after its signature has already been cataloged. – Kevin Mar 29 '14 at 0:40
