[clamav-users] Reporting malware/false negatives

Alex mysqlstudent at gmail.com
Sun Apr 2 16:44:17 EDT 2017


Hi,
I submitted a number of encrypted word macro viruses within the last
48 hours, two of which still appear to not be tagged properly. Is
there something you can say about the large number of encrypted word
doc viruses we've seen over the last few weeks?

# md5sum pbj5a57gw5-pMlSuWbYRjT1.docx g9kfak164-NZlttUtz.docx
281f596c2a5821ef52b9ed036d51d7c2  pbj5a57gw5-pMlSuWbYRjT1.docx
440f44ac9ca212b8ecf38e48faa9dfac  g9kfak164-NZlttUtz.docx

If you're reading this and would also like a sample of these, let me know.




On Wed, Mar 22, 2017 at 9:50 AM, Joel Esler (jesler) <jesler at cisco.com> wrote:
> I just added Doc.Dropper.Agent-6136130-0 to the scan system, it should be published today.
>
>
> --
> Joel Esler | Talos: Manager | jesler at cisco.com<mailto:jesler at cisco.com>
>
>
>
>
>
>
> On Mar 22, 2017, at 9:43 AM, Alex <mysqlstudent at gmail.com<mailto:mysqlstudent at gmail.com>> wrote:
>
> Hi,
>
> How long does it typically take for a sample to be analyzed and a
> pattern to be created?
>
> Generally speaking, a couple hours (sometimes 4, sometimes 8, depending on automation schedules)  Because it was encrypted, it may be a bit more difficult, so I'll have to look into it.  What is the sha256 hash of the file?
>
> # sha256sum r564t97y168d2.docx
> a68e789e8306e697874d155191376124e13e44f144b11a678a37e44036a3668d
> r564t97y168d2.docx
>
> I also included the password to decrypt it, "Vo1UPMQBgITg" as was
> included with the email when it was received.
>
>
> I don't even bother reporting them to sophos, et al because it's
> sometimes days before they're added. I was expecting better from
> clamav...
>
> Interesting, considering Sophos is not a free product.
>
> Yes, sometimes (most times?) it's days.
>
> alex
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
> _______________________________________________
> clamav-users mailing list
> clamav-users at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml



More information about the clamav-users mailing list