y0da

Who has read the 29A e-zines?

http://www.flavioweb.it/ezines/29a-7_full_edition.zip

Please look at Binaries->yoda->INCONEX.ZIP->src, and tell me what thoughts enter your mind

>>5
It misidentified a lot of those. For example, the file OP asked us to look at is not a trojan, even though it's a well-known technique for loading executables in memory without creating an extra process, which could be used in malware, and is probably why it misidentified it as a downloader trojan.
Who needs antiviruses when you can have a disassembler and a virtual machine+debugger?