[SANS ISC] Very Large Sample as Evasion Technique?

I published the following diary on isc.sans.edu: “Very Large Sample as Evasion Technique?“:

Security controls have a major requirement: they can’t (or at least they try to not) interfere with normal operations of the protected system. It is known that antivirus products do not scan very large files (or just the first x bytes) for performance reasons. Can we consider a very big file as a technique to bypass security controls? Yesterday, while hunting, I spotted a very interesting malware sample. The malicious PE file was delivered via multiple stages but the final dropped file was large… very large… [Read more]