Home/ Questions/Q 8405607
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-09T22:53:25+00:00

Okay so I’m trying to make a basic malware scanner in C# my question

  • 0

Okay so I’m trying to make a basic malware scanner in C# my question is say I have the Hex signature for a particular bit of code

For example

        {
            System.IO.File.Delete(@"C:\Users\Public\DeleteTest\test.txt");
        }

        //Which will have a hex of 53797374656d2e494f2e46696c652e44656c657465284022433a5c55736572735c5075626c69635c44656c657465546573745c746573742e74787422293b

Gets Changed to –

        {
            System.IO.File.Delete(@"C:\Users\Public\DeleteTest\notatest.txt");
        }
//Which will have a hex of 53797374656d2e494f2e46696c652e44656c657465284022433a5c55736572735c5075626c69635c44656c657465546573745c6e6f7461746573742e74787422293b

Keep in mind these bits will be within the entire Hex of the program – How could I go about taking my base signature and looking for partial matches that say have a 90% match therefore gets flagged.

I would do a wildcard but that wouldn’t work for slightly more complex things where it might be coded slightly different but the majority would be the same. So is there a way I can do a percent match for a substring? I was looking into the Levenshtein Distance but I don’t see how I’d apply it into this given scenario.

Thanks in advance for any input

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Using an edit distance would be fine. You can take two strings and calculate the edit distance, which will be an integer value denoting how many operations are needed to take one string to the other. You set your own threshold based off that number.

    For example, you may statically set that if the distance is less than five edits, the change is relevant.

    You could also take the length of string you are comparing and take a percentage of that. Your example is 36 characters long, so (int)(input.Length * 0.88m) would be a valid threashold.

    • 0