I have found some software on 1337 that a friend was asking for. It's for Windows and I'm on Linux. Is test running the software inside a VM the only way to securely vet it (to see what connections it tries to make and what processes it starts)? On VirusTotal, I get one positive and 66 negatives. Preferably, I'd like to hand over the software without worrying about giving them malicious code...

The title had me very confused for a few seconds. "Are you talking about cows? Why would they need to be executed? And why would they need vets before execution?"

VirusTotal also tells you a load of stuff about file read/writes and network access etc. What did it say? And what was the positive result for?

You can also acquire the original executable, and compare the differences in a binary/hex editor. VM runs would be after you have sanitized the EXE.

God this genuinely made me laugh. Thanks!

Holy crap, I had no idea! Cool!

The one positive is a malicious.high.ml.score by Trapmine and I can't makes heads or tails of it.

Domains  
e592.d.akamaiedge.net
www.msn.com
www.msn.com.edgekey.net

IP  
23.50.32.0/20 (owned by Akamai Technologies, Inc.)

Execution Parents  
Crack 29.2.ZIP

None of these sub categories under Relations give any positives.

In theory I agree, but other than buying the original executable from a reputable vendor, I have no way of verifying the integrity and authenticity of the EXE.

Run them on your mate's PC first

Absolutely NOT a stupid question! 😊 They are not very tech savvy 🥺

Normally I would get turned on by that, but I'm trying to be a nice person.

ask someone that bought the executable to lend you theirs.

One thing to remember with VirusTotal is that it should only be used as a "tool of consensus". A lot of AV solutions on their list will false flag binaries presumably to instill fear and get people to buy their solutions over more reputable AV providers. You want the AV that works the best which many people would equate to the most flagging (as logically incomplete as that may be).

If you are seeing 66 flags and many of those being from reputable vendors, then I would say that what they show is likely accurate. Accuracy and relevance being two different things. 100% accuracy on keygen tools doesn't mean that it is a relevant flag to what you're trying to do.

You could try software solutions like LOKI (the IoC scanner) or Azul to test specific binaries, though. I believe LOKI is just doing static analysis, but Azul I know automates the sandboxing.

You can also put it through sandboxes like joesandbox or cuckoo to try to trigger and detect a payload. But some malware will expect this and not execute.

Ultimately, judge your own risk tolerance by how much you trust the source, how much you want the software, what kind of systems protection you have in place (antivirus, antimalware, permissions control, backups), and how much you can afford to have your system compromised.

theres any.run but it needs an account

Step 1: make an enemy for life

Step 2: copy questionable .exe to their pc

Step 3: ???

Step 4: profit

That doesn't look suspicious to me.

If you have the executable from a trusted source, then you don't need to spend your time determining if a version you got from an unsafe location is legitimate, you'd just make a copy of the trusted original and throw out the bootleg to be safe.

"but my enemy runs linux!"

what software is this?

https://en.wikipedia.org/wiki/Archicad

VirusTotal is probably the best you can do. Although, I think it belongs to Amazon or some big company now after being bought up.

i think you can use appdoze cracks. they've had malware incidents at least once iirc but still considered mostly trustworthy as they got rid of the offending upload and stuff.

ArchiCAD uses a now-usual DRM scheme of either checking a hardware thumbstick key or seeking for a background licensing server at localhost or a set IP (always-on machine with a pool of licenses one can take one from).

https://help.graphisoft.com/AC/25/INT/_AC25_Help/003_InstallGuide/003_InstallGuide-4.htm (is it the version OP got?)

A cracker should either patch the requirement off completely (or drop exe, dlls for in-place replacement) or emulate a suitable key/server that is a separate app. With a lot of software I pirated with this DRM model it's usually the second way, emulating a server with always correct responses. If that's the case, the primary exe file can as well be original (of some distinct version?) but the crack happens to a separate background program installed with the main app.

I think we need another look at what is actually downloaded by OP and if there is some patching process jnvolved or everything is provided already cured. Then, to see and notice what processes are running in the VM, what they try to do.

Thanks for the tip! I think I'll leave it to my friend to deal with any reprecussions. I have informed them about the risks and how they can potentially alleviate them (VM, antivirus, firewall, backups, bootable media, isolated hardware, whathaveyou).

Thank! VirusTotal does seem to have a lot more features than I initially thought/knew. :)

I can't really tell if that's sarcasm, but if it is, then this is a piracy community, so "Crack" doesn't mean much here. If it isn't sarcasm, then: yep. :)

Thanks! By the way, have you done any time yet for RUI (rooting under the influence)?

Thanks for the clarification on what the results on VirusTotal mean or how to interpret them!

Ultimately, judge your own risk tolerance by how much you trust the source, how much you want the software, what kind of systems protection you have in place (antivirus, antimalware, permissions control, backups), and how much you can afford to have your system compromised.
Thanks for this! I finally decided to hand the matter over to my friend, because vetting the binaries are just... a whole project on(in?) its own. I sent them exactly what you wrote, in addition to some concrete guidance on how to setup VMs, create backups, bootable media, whathaveyou.

Now we're talking. I have a few... candidates. Except, unless they leave their card in the computer, I can't access their login. Hm... and IT records all activity. HMMM...

In this economy? Better to buy a house.

there are houses less than 7k€‽

i have im in a rehab program and AA

Right! One of the rear ports, which nobody ever looks at. Although, if I'm going to script, I'm not going to become one of those copy-paste script kiddies. I'm going to LEARN it until I know it by heart and then PROGRAM the shit out of it.🤣

TF2_nemesis.wav

They're the ones in the secret cow level.

It might possible to build a tiny house for such a price?

ML means machine learning. One clanker out of 66 said it's a virus. Do you believe it?