Tuesday, February 23, 2010

Bypassing Antivirus using De-Obfuscation

About six months ago I was working on an idea for a new executable packer. Before I started coding, I performed some tests to see how easy current Antivirus products can be bypassed.

I chose the tool PwDump3 for testing as I did not want to handle real malware for the small test and this was sufficient as most AV products detect it as malicious software.

Two of my tests were quite simple:

Test1:
  • pack the program with upx
 Test2:
  • pack the program with upx
  • rename sections
  • add a time consuming loop to the programm, hoping that an AV scanner using generic unpacking will fail

The second test was somewhat successful - the detection rate dropped by 50%, whereas the first one did not really help bypass detection.

Now I wanted to take up the project again - checking what I did 6 months ago I also re-uploaded the testfiles to virustotal. To my surprise, these two testfiles led to almost identical results: 31/41 compared to 28/41.
As we all know and Kaspersky showed again recently, AV vendors often add detection for programs that are detected by other vendors, so one question arises: did they just add a static signature detecting my obfuscated version of the program or did the generic detection really improve?

The time consuming loop was really trivial, this is the code:

pushad
mov eax, 5
outer:
mov ecx, -1
inner:
xor ebx, ebx
loop inner
dec eax
jnz outer
popad

It should be fairly easy to detect something like that. I modified the executable so that it jumps to the end of the code section, executes the loop and then returns to the original entry point of the program.

After renaming the sections back to their original names set by UPX and replacing the loop with NOPs, I uploaded the program again. Surprisingly, only 16 of 39 scanners still detect that one, so now I bypassed 12 AV products by removing the obfuscation originally implemented...

9 comments:

  1. This comment has been removed by the author.

    ReplyDelete
  2. Your blogs are great.Are you also searching for philosophy of nursing? we are the best solution for you. We are best known for delivering nursing writing services to students without having to break the bank.

    ReplyDelete
  3. Such great content.This is authentic. Are you also searching for nursing writing services login? we are the best solution for you. We are best known for delivering the best

    ReplyDelete
  4. Hey people! If some of you really necessity assistance with essay or homework, you can ask this guys for help! They really know how to do it, and you can rescue your money and time! Check this best ghost writers and go for it! Excellent luck and have fun, my friend!

    ReplyDelete
  5. Thanks for joining us! Don’t let those assignments stress you if you don’t know how to complete them yourself. Read on to learn how you can benefit from our master papers custom essay writing service. Here are some groups of students who can benefit from custom paper help.

    ReplyDelete
  6. On the site https://paperwritingservice.net/ you will find many proposals from competent authors in various academic disciplines, and the set deadlines and low cost make custom coursework services available to every student

    ReplyDelete
  7. The exploration of bypassing antivirus using de-obfuscation technique cybersecurity and the need for continuous innovation to stay ahead of malicious actors. VPN For Streaming It is crucial in strengthening our defence against potential threats.

    ReplyDelete
  8. Ledger Live is an item application made by Ledger, an association having some mastery in gear wallets for computerized monetary standards. |
    Trezor.io/start is an application or programming point of interaction that is worked to give a multi-useful crypto stage for Trezor gadgets.

    ReplyDelete
  9. 如果留学生需要在短时间内完成一篇作业或论文,那么代写服务的价格会相对较高,因为这意味着代写人员需要加班加点来完成任务。此外,作业的难度和学科领域也会对价格产生影响。一般而言,理科类作业代写https://www.lxws.net/价格会相对较高,因为需要更专业的知识和技能。

    ReplyDelete