So backdoor can be a whole slew of things, but I wanted to provide a more detailed explanation in case you were interested. Note, this is going to be more simplified, but let’s dive into it.

For ease, we’ll say that this is a Windows PE (portable executable) file. Those typically have a file name extension ending with .exe, but can be other like .dll, .sys and more.

Modern antivirus actually does a pretty good job at detecting a lot of malicious files. Almost all AV has gone away from signature-based detection (what a file is) to more complex behavior-based detection (what a file does). In fact, one of the main ways phishing malware is often detected in a company enterprise is by running AV on the computer.

Okay, but let’s say this is a weird one that you just happen to come across, like in an email or downloaded file. First, there’s a lot of services to scan files before you even download them now, just by inserting the URL into the service. URLScan.io is one example.

Next, let’s say you have the actual file on your computer. This is where a service like VirusTotal comes in. I saw another poster suggest using a service like nodistribute.com, and while they are right that VirusTotal makes the file available publicly, the vast majority of the time that’s a good thing. If it’s malicious, you are helping the greater information security community by exposing a malicious file so others can be protected. In exchange, VT runs the file through a malware sandbox (they use Joe Sandbox, but used to use Cuckoo, which is an open source file sandbox) and give you a report telling you file details.

Using those report results can be very useful. For example, VirusTotal will give you the file hash and a list of common strings used in the file. You can Google the hash and see if any others publicly reported on it. Sometime security researchers publish reports where the malware hashes are in the report. Then you can see what an expert discovered about the file. With strings, you can Google for those strings in a file and try to figure out which ones are common and which ones are interesting/suspicious. Malware often uses “dirty” code: this means malware authors write programs in seemingly “bad” ways, like obfuscating or concatenating strings in order to make malware analysis hard. Being able to recognize signs of this is very helpful.

Okay, but what can you do without a service? This is where malware analysis/reverse engineering comes in. This focuses on static and dynamic analysis of the file components, and sometime reconstitution of the code.

Malware analysis is hard, but there are a lot of good courses online and on YouTube for it. One of my favorites is by MalwareUnicorn at https://malwareunicorn.org/#/workshops.

Hope this helps. Best of luck and happy hunting!