Whether samples downloaded from virus share can execute automatically in my computer

Question

I am doing some android malware analysis work and downloaded many android samples in virus share, but I found some of them are windows malware e.g. labeled 'win32' or something.

Are these windows malware samples able to execute automatically in my computer even if I didn't add a proper extension name for them e.g '.exe'?

I am afraid it may damage my computer or leak some private data...

The samples that I downloaded is from this zip file.

To simplify the question that I want to ask is: Whether a sample that has no extension name can excute automatically？

Possible duplicate of How can I analyze a potentially harmful binary safely? — julian, Feb 10 '18 at 13:50
In the past this was impossible, but then Windows, among other OSes, might hide the extension, so you think it's not there while it is :) So if you're sure the extension is not hidden then nope. Then again, I haven't touched Windows for years, this guy says the opposite https://superuser.com/a/690608 — Vitaly Osipov, Feb 12 '18 at 00:12
Thx, Vitaly. The samples need to add the extension name and I didn't run the cmd script. xD @VitalyOsipov — Sayuki, Feb 12 '18 at 11:54
To be on safer side, download them in an sandbox environment (VM) — S Nikale, Jul 14 '21 at 18:28

score 1 · Answer 1 · answered Feb 11 '18 at 05:02

The simplest and most common type of malware depends on you executing it, but malware can target vulnerabilities in any program that processes the data.
There are a few cases where simply downloading a file without opening it could lead to execution of attacker controlled code from within the file. It usually involves exploiting a known vulnerability within a program which will handle the file in some way. Here are some examples:

Windows will try to extract information from the file to display the icon and preview when looking at the folder inside explorer (such as PDF or image thumbnail). One example was the Windows Metafile Vulnerability which could be exploited only by previewing the file in explorer.
Another attack vectors is the builtin Windows Search. To extract the information necessary for a full text search Windows will scan the files in the background and use the file parser to extract the content. A bug in the file parser can thus lead to code execution.
The file targets a vulnerability in your antivirus which triggers when the file is scanned
The file targets a vulnerability in your file system such as NTFS where the filename or another property could trigger the bug
A library file (ex. dll) could get executed when saved to the same directory where an application vulnerable to binary planting is executed from

Thanks, maybe it's better to buy a new hard driver.. but the samples have been deleted the extension name, so I am wondering if they can still excute.. — Sayuki, Feb 11 '18 at 08:08

Whether samples downloaded from virus share can execute automatically in my computer

1 Answers1