WEBVTT 00:00:00.540 --> 00:00:04.520 In some cases, your executable might get flagged by antivirus, 00:00:04.530 --> 00:00:07.380 even though you have encoded the stager and you didn't use 00:00:07.380 --> 00:00:10.780 the built‑in executable templates or any of the Metasploit 00:00:10.780 --> 00:00:13.760 formats such as exe or exe‑only. 00:00:14.240 --> 00:00:17.760 In this case, it might be because your executable file is 00:00:17.760 --> 00:00:20.180 showing signs that it might be malicious, 00:00:20.190 --> 00:00:23.700 even though no solid signatures can be matched on the file. 00:00:23.890 --> 00:00:26.490 When you think about how a malware analyst usually 00:00:26.490 --> 00:00:29.970 statically analyzes potentially malicious files, 00:00:30.070 --> 00:00:33.820 you will find that he usually checks various characteristics. 00:00:34.140 --> 00:00:39.100 Antivirus tries to automate this process by extracting these characteristics 00:00:39.100 --> 00:00:43.300 from the file and feeding them to classification models and various 00:00:43.300 --> 00:00:47.820 algorithms in an attempt to make a statistical decision about whether or not 00:00:47.820 --> 00:00:52.360 the file is indeed malicious. Things which might be a strong indicator that a 00:00:52.360 --> 00:00:57.060 file is malicious to a malware analyst will also possibly contribute to the 00:00:57.060 --> 00:00:59.050 overall score of a file. 00:00:59.140 --> 00:01:03.120 We should therefore pay close attention to these aspects when we craft our 00:01:03.120 --> 00:01:08.450 executables. Things to avoid are having too few imports in the import address 00:01:08.450 --> 00:01:13.210 table of our executable. A file which doesn't import functionality from the 00:01:13.210 --> 00:01:17.910 operating system is a good indicator that it might be obfuscated and that it 00:01:17.910 --> 00:01:22.430 may attempt to resolve APIs without the help of the operating system's loader 00:01:22.440 --> 00:01:23.760 and dynamic linker. 00:01:23.940 --> 00:01:27.560 This is indeed the case when we use MSFvenom to generate the 00:01:27.560 --> 00:01:32.480 stager. Adding random and benign APIs to the import address table 00:01:32.490 --> 00:01:34.610 could make the file look less suspicious. 00:01:34.800 --> 00:01:39.450 Another thing you should avoid is importing frequently‑abused APIs. The 00:01:39.450 --> 00:01:43.570 presence of these APIs in the import address table will make your executable 00:01:43.570 --> 00:01:47.290 look more dangerous and therefore more likely to get flagged by the 00:01:47.290 --> 00:01:52.550 antivirus. You may recall from previous modules where we discussed MSFvenom's 00:01:52.550 --> 00:01:57.380 exe and exe‑only format that they both rely on memory sections which have 00:01:57.380 --> 00:01:59.160 read/write execute permissions. 00:01:59.170 --> 00:02:02.220 The main reason for this is that in the case we choose to use an 00:02:02.220 --> 00:02:06.500 encoder, this is required and by design. Therefore, the presence of 00:02:06.500 --> 00:02:10.130 read/write execute memory sections will increase the probability that 00:02:10.130 --> 00:02:12.060 your executable will be flagged. 00:02:12.540 --> 00:02:17.150 Finally, entropy is also something which might be calculated by an antivirus. 00:02:17.160 --> 00:02:19.370 Since when we run the stager for an encoder, 00:02:19.380 --> 00:02:23.670 we essentially end up with invalid code, which may contain unusual 00:02:23.670 --> 00:02:27.370 instructions, which usually do not appear very often in valid code. 00:02:27.380 --> 00:02:30.750 There's a good chance that this might be frowned upon by an antivirus, 00:02:30.760 --> 00:02:33.410 especially if the code is in the read/write execute 00:02:33.410 --> 00:02:35.760 memory section of the executable file. 00:02:36.040 --> 00:02:39.400 There are, of course, other characteristics, which will also be taken into 00:02:39.400 --> 00:02:43.430 consideration when calculating the final score for a given file, things 00:02:43.430 --> 00:02:47.780 such as alternate data streams and, in particular, the mark of the web or 00:02:47.780 --> 00:02:50.140 the file's placement on the filesystem, 00:02:50.150 --> 00:02:53.650 as well as the permissions on the file may also be considered. 00:02:53.740 --> 00:02:57.450 The reason being that a file having been downloaded from the internet 00:02:57.460 --> 00:03:01.590 and located in the user's download folder is more likely to be malicious 00:03:01.600 --> 00:03:04.110 than a file in the program files directory, 00:03:04.120 --> 00:03:06.720 which a regular user could not even write to. 00:03:06.810 --> 00:03:10.430 Digital signatures will also be taken into account. Broken 00:03:10.430 --> 00:03:13.770 or untrusted signatures are sure to get your executable file 00:03:13.770 --> 00:03:15.960 quarantined by the antivirus.