How is there PE file data that doesn't change?

Question

Malware

Hello.
I want to write something like an antivirus for one virus, but I can't figure out how to detect it? The matter is that in a virus it is possible to specify any data. The path where it will be saved, etc. I'm going to run through the processes and compare with some PE information, but raw data etc. is not suitable, because after UPX or any other protector - they change. What data can be used to accurately determine that this is the file?

Answer 1

No way. If everything were so simple, then the virus industry would not have earned so much. And the antivirus industry.
Now antiviruses apply complex measures. For example, monitoring traffic, tracking strange calls to the operating system API, analyzing the operation of the program code, etc.