Evading Scanners
Joxean Koret, Elias Bachaalany · 2015
This chapter explains how to evade both static scanners (which only focus on files that are on disk) and dynamic scanners (which focus on the behavior of the program or that perform memory analysis). It presents some tricks that can be used to evade many antivirus scanners. The chapter lists various anti-emulation tricks that are generic for Windows PE files, for any x86-based program, and for the Adobe Acrobat JavaScript interpreter implemented as support for dynamic PDF files. Anti-attaching techniques are used to prevent a debugger from being attached to the current process. The chapter shows how to write a simple antivirus evasion tool. It shows how to write a tool for automatic antivirus evasion that will make use of the MultiAV and peCloak. The chapter concludes with a hands-on section showing how to automate all the required steps for researching and testing evasion techniques.