2

I've been experimenting with how antivirus detect trojan signatures to get my head around a couple things for CEH certification. This has mostly involved playing with variations of windows EXEs.

I'm compiling on a Kali VM using 'i686-w64-minw32-gcc' and submitting the results to Virus Total. A few of the antivirus services will detect my EXEs as malicious regardless of the contents. Even a main(){ return 0}.

I'm thinking that there is something detecting the simple fact that I'm compiling on Kali. I tried a couple basic things - most notably going through strings my.exe - and nothing really came up.

How can I look deeper into this?

  • 3
    Yes, its your compiler that the AV engines are barking at. – schroeder Nov 3 '16 at 19:13
  • 1
    I imagine the lack of publisher, company name and digital certificate would have something to do with it. Also the minimal size and lack of imports would raise suspicion. Can you post a link to the executable? – Will Aug 1 '17 at 16:28
2

Try PEStudio. It will cut and gut your individual EXE and then rank the individual parts on VirusTotal. Very interesting.

We'd need a sample EXE to tell you more.

https://blog.malwarebytes.com/threat-analysis/2014/05/five-pe-analysis-tools-worth-looking-at/

0

Since AV technology is mostly proprietary, I won't be able to help there.

If you want to look deeper into file, IDA Pro free 5.0 can usually make some sense of file, but there are other tools. Probably keyword you are looking for at: debugger, disassembler.

If you want to know more about PE/EXE standard, and it's reality I'd recommend corkami, which deals with reality of format, rather than standards that Microsoft recommends.

As for how your compiler is detected: very likely this is string in a file, if it's not then it can be detected by countless references to it's library etc. - that's quite likely to upset antiviruses, because big part of file matches a known virus...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.