Virus scanners can produce both false positives (flagging safe software as malicious) and false negatives (failing to recognize malicious software), and malware developers are well aware of the need to avoid detection by antivirus software.Īnother thing to consider is how trustworthy the file's source is. Running the binary through VirusTotal is a good idea, but all it can tell you is 'would any antivirus software detect this as malicious?' and that's not enough info. However, not all such obfuscated code is malicious things like license-checking and DRM-enforcing libraries are generally very obfuscated as well, as are any binaries that contain highly-sensitive proprietary algorithms that the developer/publisher is trying to keep secret. Modern malware is often heavily obfuscated (by hand and/or with a utility), both to deter reverse-engineering and to try to bypass antivirus checks. There is no practical way to tell, for sure, that a binary is not malicious. That's not to say it's worthless to try, but it's far from guaranteed that you'd succeed (and you don't have the source to this binary anyhow). The International Obfuscated C Code Contest and especially the Underhanded C Contest are neat repositories of examples showing how hard it is to tell what a C program/library is doing, and how safe it is. Note that even if you had the original source code (which no tool can give you), unless you are extremely adept at source code analysis there's no guarantee you'd be able to determine if the library is malicious or not. Both of these are commercial (and expensive) programs, although you can get an evaluation version of IDA. The developer also publishes a decompiler, which tries to turn the binary code into something resembling C source code. IDA (Interactive DisAssembler) is the most popular tool for disassembling native binaries back into something that is approximately human-comprehensible, though it's still not trivial to use correctly and may take some time to become proficient.

For native code binaries, reverse engineering is hard (though not impossible).

Is dll files safe