Blog | G5 Cyber Security

Check Suspicious File Content (Server)

G5 Cyber Security

TL;DR

Yes, you can check a suspicious file’s content directly on the server using an editor like vim. However, be extremely careful! Opening potentially malicious files even for viewing carries risks. Use precautions as outlined below.

Steps to Check File Content Safely

  1. Understand the Risks: Before you do anything, know that opening a file with vim (or any editor) could trigger code execution if the file contains malicious scripts. This is especially true for executable files or those with unusual extensions.
  2. Isolate the Environment: If possible, work on a dedicated server or virtual machine that isn’t critical to your operations. This limits the damage if something goes wrong.
  3. Check File Permissions: Verify you have read access but *not* write access to the file. Use ls -l in the terminal. 
    ls -l suspicious_file.txt

    The output will show permissions like -r--r--r--. The first three characters after the hyphen indicate owner permissions, the next three group permissions and the last three other user permissions. ‘r’ means read access, ‘w’ write access and ‘x’ execute access.

  4. Use vim with Caution: Open the file in read-only mode. 
    vim -R suspicious_file.txt

    The -R flag forces vim to open the file in read-only mode, preventing accidental modifications.

  5. Examine the Content: Carefully review the file’s content for anything unusual.
    • Look for obfuscated code or scripts.
    • Be wary of commands that download other files or execute programs.
    • Pay attention to unexpected characters or strings.
  6. Avoid Executing Commands: Do *not* attempt to run any commands found within the file, even if they seem harmless.
  7. Close vim Immediately: Once you’ve examined the content, close vim without saving any changes.
    • Press Esc.
    • Type :q! and press Enter to discard any modifications.
  8. Consider Alternatives: If you’re unsure about the file, use safer methods for analysis.
    • head/tail: View only the beginning or end of the file. 
      head -n 10 suspicious_file.txt
      tail -n 10 suspicious_file.txt
    • strings: Extract printable strings from the file. 
      strings suspicious_file.txt
    • Online Sandboxes: Upload the file to a reputable online sandbox for automated analysis (e.g., VirusTotal).
  9. cyber security Scan: After examination, run a cyber security scan on your server using an up-to-date antivirus or intrusion detection system.

Important Reminders

Exit mobile version