CyberCapture

[Be Secure]

Be Secure, we've checked the backends, according to their logs we don't see the file as being downloaded from web (there is not URL field in the logs).
Of course, this can be some kind of an error in the processing. Could you, please, specify how you've downloaded the file? Was that a direct download (click on the url), or some other mechanismus (e.g. some downloader). What make of the browser did you use to download the file? Thanks a lot,
Lukas.

I used both direct download links and use IDM(Internet Download Manager),Google Chrome x64 stable version.

[TrueIndian]

This feature is quite broken...lot of downloaded files are being missed...Is this bug something with download managers or browsers?


another report:
https://forum.avast.com/index.php?topic=187505.0

[RejZoR]

Thanks RejZoR for your comment. Seems rather in line with what you've been saying from the begining and on several places in this very thread. If I understand you correctly, you'd suggest to not limit CC to downloaded files only and expand the backends accordingly. Do you have any suggestions how to handle the case where the file it self requires dependencies to be run (such as .DLLs in the same folder) ? Would that be ok for you if CC will submit the whole folder - or would you consider that as a privacy issue?

Thanks.
Lukas.

BTW: Be Secure - I got the logs from you, thank you!

Yeah, I think that way because of all the problems I've seen so far and because of the CyberCapture dependencies...
You have to have CyberCapture enabled, Web Shield installed (a lot of people leave just File System Shield) and the file has to arrive from a download. Just too many things that can go wrong along the way or be missing. Connecting CyberCapture to the File System Shield would make more sense.

As for DLL's, can avast determine DLL dependencies for EXE to run or would it just blindly upload all of them from that folder? If you limit the file collection to DLL's only, I think it should still be fine, but I don't think people would want their other data files to be uploaded. Besides, DLL's can often operate as injectors for legit apps which can be used by malware. So, that would be one of reasons why uploading them would make sense.

What I'm more worried with such extended scope of upload, people with limited bandwidth. I personally don't care as I have unmetered line, but not everyone has it like I do. Not sure how to make that functional without eating their whole monthly bandwidth...

[Be Secure]

Thanks RejZoR for your comment. Seems rather in line with what you've been saying from the begining and on several places in this very thread. If I understand you correctly, you'd suggest to not limit CC to downloaded files only and expand the backends accordingly. Do you have any suggestions how to handle the case where the file it self requires dependencies to be run (such as .DLLs in the same folder) ? Would that be ok for you if CC will submit the whole folder - or would you consider that as a privacy issue?

Thanks.
Lukas.

BTW: Be Secure - I got the logs from you, thank you!

Yeah, I think that way because of all the problems I've seen so far and because of the CyberCapture dependencies...
You have to have CyberCapture enabled, Web Shield installed (a lot of people leave just File System Shield) and the file has to arrive from a download. Just too many things that can go wrong along the way or be missing. Connecting CyberCapture to the File System Shield would make more sense.

As for DLL's, can avast determine DLL dependencies for EXE to run or would it just blindly upload all of them from that folder? If you limit the file collection to DLL's only, I think it should still be fine, but I don't think people would want their other data files to be uploaded. Besides, DLL's can often operate as injectors for legit apps which can be used by malware. So, that would be one of reasons why uploading them would make sense.

What I'm more worried with such extended scope of upload, people with limited bandwidth. I personally don't care as I have unmetered line, but not everyone has it like I do. Not sure how to make that functional without eating their whole monthly bandwidth...

+1.Good point.@RejZoR

[Be Secure]

Finally some good news!. :)wait for result.But file not lock at all,it still run. After long wait it say the file is clean but it is not.

[mchain]

Finally some good news!. :)wait for result.But file not lock at all,it still run. After long wait it say the file is clean but it is not.

Otherwise known as a false negative.  With double file extension name such as this one, this should not be missed by any reputable a/v.  As RejZoR says, merging this new technology with File System Shield makes sense... as it should natively catch it.

[RejZoR]

I'm surprised their internal classification system doesn't push files like this to a SUSPICIOUS group by default. I mean, .pdf.exe extension is a textbook scam method to convince users into running it thinking it's just a PDF file.

[pk]

I'm surprised their internal classification system doesn't push files like this to a SUSPICIOUS group by default. I mean, .pdf.exe extension is a textbook scam method to convince users into running it thinking it's just a PDF file.

There is a rule for double extensions, these files were always analyzed by DeepScreen.

As for DLL's, can avast determine DLL dependencies for EXE to run or would it just blindly upload all of them from that folder?

It is not so easy -- a lot of DLLs can be loaded dynamically and it depends on many factors if it happens, or not. The first version of CC works on installer/packages downloaded from Internet (assume all DLLs components are in the installer). We will definitely improve it in future.

[RejZoR]

How often are dual extensions intentional? Especially such specific ones? Only legit one I'm aware is .paf.exe used by Portable Apps. But PAF isn't any common format. So it's fine. But seeing .PDF.EXE, that has ALWAYS been malicious. Is there even a point of analysis, it's 99,99% certain it's malware.

[Be Secure]

How often are dual extensions intentional? Especially such specific ones? Only legit one I'm aware is .paf.exe used by Portable Apps. But PAF isn't any common format. So it's fine. But seeing .PDF.EXE, that has ALWAYS been malicious. Is there even a point of analysis, it's 99,99% certain it's malware.

+1.https://www.virustotal.com/en/file/7f46fd0233344d45057a1401d9593889e39340d85163126c9730fcf74949137d/analysis/1467944091/

[TrueIndian]

Any news as to why that file was classified as safe?! That is 100% bad...something is definately wrong on the backend 

Any news avast! team?

[REDACTED]

4.Is the sandbox and cybercapture now one and the same?? If not what's the difference?? Analysis on users machine and analysis on cloud is the only difference.

Sandbox (DeepScreen) is a part of CyberCapture. We use it both locally (on the user's computer -- to filter out the most obvious malware) and also on the backend (in a controlled environment, with full NG support and much more time to play with it).

Sorry for dumb question but is NG removed from latest Avast ?  I know alot of performance and other issues.....one of the items/features/options I shy-ed away from.
Thus, maybe extension to the question above.....how does DeepScreen, Cybercapture & NG relate ?

[Asyn]

Sorry for dumb question but is NG removed from latest Avast ?

Yes, it has been moved to the cloud.

[NON]

Any news as to why that file was classified as safe?! That is 100% bad...something is definately wrong on the backend 

Do you expect 100% detection from CyberCapture? I don't think it happen or exist, 100% is just an illusion IMHO.
"Improved" detection rate at most is, still, a good advance.

Of course I expect CC to be improved, but now, let's wait and see.

[TrueIndian]

Sorry but that malware is very wide spread and a feature like CC shouldn't miss it....Its very well known varient and backend shouldn't be missing well known malware varients like rejz said this dual extension thing has been around for years and it shouldnt be missed where all other vendors have some heuristic detection in place for such files avast! seems to have no protection from a well known varient... atleast if its not a 100* detection 

I am not saying get 100% score but atleast don't miss the real bad ones.This feature is heavily broken right now.It's missing everything I have thrown at it...even my kitchen sink was missed