6

I have written a very simple/basic crypter in C++ and I would like to test it. How would I go about writing a simple MessageBox program that is "tainted" so that my Anti-virus will attempt to quarantine it upon running the file? Right now, I just have a MessageBox outputting "Hello".

I need a suspicious signature.

P.S. It is a runtime crypter. I worked on it after reading this white paper: http://www.exploit-db.com/wp-content/themes/exploit/docs/18849.pdf

1
  • Justin, is your crypter avilable somewhere? I would love to test it! Right now I'm using the Crypter from www.crypter.com , I'm satisfied with it but I would try a new one. To test it against your antivirus, just crypt a detected keylogger and see how's working.
    – user33018
    Nov 8 '13 at 23:07
12

An idea would be to use the EICAR string. This string was developed to test anti-virus. Try to make a program with that, see if it triggers your av and then apply your crypter.

5
  • Would something like this work? pastebin.com/2JZp7LWd I compiled it, and it outputs a text file with the EICAR string. The Antivirus did not assume it was a virus. Am I doing something wrong? Oct 21 '13 at 21:01
  • Have you run the AV on that file explicitly (like right-click "scan this file") or have you depended on the on-access scanner? In latter case the AV might just miss the access event. You should also check the AV whitelists: sometimes they whitelist files automatically based on some strange rules.
    – buherator
    Oct 21 '13 at 21:59
  • That was strange. Now the AV attempts to kill the file as it's being saved. Thank you. Oct 21 '13 at 23:29
  • As lucas suggested above you can try that method, you can also check out Soft Crypter google it, you can maybe use some of their ideas.
    – user32779
    Nov 4 '13 at 12:17
  • @user32779 Thanks. Why would I want to buy a crypter when I can code one myself? I will learn a lot more anyway. Dec 4 '13 at 18:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.