What is a malicious file?¶
A malicious file is a file created, altered or used to support unauthorised or harmful activity.
Avoid the dangerous assumption¶
The dangerous assumption is that a file extension or antivirus label conclusively identifies what the file is.
It does not.
A malicious file may appear as:
- a document
- an archive
- an executable
- a script
- a shortcut
- an image or media file
- a library
- an installer
- another ordinary-looking format.
The visible filename and extension can be misleading. Extensions may be hidden, doubled or changed. The file’s internal format may not match its name.
A file may also be legitimate software used for a malicious purpose. In that case, the file itself may not be inherently malicious.
Investigators should preserve:
- the original file
- its full path
- filename and extension
- size
- hash values
- timestamps
- source of acquisition
- security detections
- associated messages or downloads
- process and network activity.
Do not alter the file by opening, renaming or resaving it unnecessarily. Use specialist support for safe examination.
Ask how the file arrived.
Was it emailed, downloaded, created by another process, copied from removable media or placed through remote access?
Then ask what happened next.
Was it opened, executed, extracted, loaded by another program or blocked?
A malicious-file finding may help link incidents where identical hashes or characteristics appear elsewhere. But a shared hash does not identify the offender. Files can be copied and widely distributed.
Where several copies exist, preserve their locations and acquisition routes. Identical content in an email attachment, download folder and quarantine area may represent one delivery event rather than three separate malicious acts.
Operational takeaway¶
Preserve the file and its surrounding context, and distinguish its appearance, internal format, delivery, execution and actual effect.