adamdriscoll / amsi Goto Github PK

Hi Adam Driscoll,

I am trying to use AMSI methods based on "NativeMethods" C# class which is provided in this project for malware scanning. Mainly, i am using "AmsiScanBuffer" method for my requirement.

My requirement is to scan a Zip file. I am verifying my implementation by passing byte array of the Zip file, stream which contains a "EICAR-STANDARD-ANTIVIRUS-TEST-FILE" to this "AmsiScanBuffer" method. But this method is not detecting it as malware. If i use this file directly without zipping, it is detecting it as a virus file.

At the same time, if i am trying to unzip the same Zip file on the disk, Windows Defender is properly detecting it as a malware file and deleting it.

Can you please provide some input on what could be the problem. Or, is it a limitation of AMSI methods ?

Thanks in advance.

Regards,
Kiran