Locating Signatures in Files
To begin, let’s discuss the process of bypassing antivirus signature detection.
Early signature-based detection methods compared file hashes,
which meant that detection could be evaded by changing a single byte
in the scanned file.
Obviously this is a trivial exercise.
Signatures based on byte strings inside the binary are more tricky to bypass
as we must determine the exact bytes that are triggering detection.
There are two primary approaches to this.
The most complicated approach involves reverse-engineering the
antivirus scanning engine and signature database to discover the actual signatures
A second, much simpler approach, is to split the binary into multiple pieces
and perform an on- demand scan of sequentially smaller pieces
until the exact bytes are found.
This method was originally implemented in a popular tool called Dsplit.
Since the original DSplit tool is no longer available,
we will instead rely on the Find-AVSignature PowerShell script
for this task.
Before starting our analysis, we’ll launch the Avira Free Antivirus GUI
and open the Antivirus pane.
In the new window, we’ll click Real-Time Protection
and switch it “off”.
For this example, we’ll generate a 32-bit Meterpreter executable,
and copy it to the Tools folder on our Windows 10 victim machine.
This will serve as our malicious binary.
Next, we’ll open a PowerShell prompt with the -Exec bypass argument,
and import the Find-AVSignature script
The script accepts several arguments.
First, we’ll specify the start and ending bytes with
StartByte and EndByte respectively.
In our first run, we’ll specify a starting byte of “0”
and an ending byte of “max” to scan the entire executable.
We’ll use the Interval parameter to specify the size of
each individual segment of the file we will split.
This value will depend on the size of the executable,
but since the 32-bit Meterpreter executable is roughly 73 KB,
we’ll set each segment to 10000 bytes.
Next, we’ll specify the input file with Path and the output folder with OutPath.
We’ll also pass the Verbose and Force flags to gain additional console output
and force creation of the specified output directory, respectively.
Pay close attention to this output.
Note that the first binary contains zero bytes.
The second binary contains 10000 bytes.
This means that the second file contains bytes 0-10000 of our Meterpreter binary.
Now that we have split our Meterpreter executable into segments
and saved them to avtest1, we can scan them with ClamAV.
This must be done from the command line,
so we’ll open a new administrative PowerShell prompt,
and navigate to the ClamAV folder under program files
From here, we’ll launch the clamscan executable,
running the scan against the segments in the avtest1 folder
We find that the first file passes detection.
This is no surprise, since it is empty.
The second file, which contains the first 10000 bytes of our binary is clean as well
This means that the first signature was detected in the third file,
somewhere between offset 10000 and 20000.
Note that offsets and number of detections found may vary for each generation
of a Meterpreter executable.
To investigate further, we’ll run Find-AVSignature again
to split the Meterpreter executable with 1000 byte intervals,
but only from offset 10000 to 20000.
We’ll change the output directory to avtest2
in order to separate the output from our various iterations.
Next, we’ll scan these segments.
The results indicate that the offending bytes are between offsets 14000 and 15000
Let’s narrow this further by lowering the interval to 100 bytes
and saving to a new directory.
We’ll scan these segments:
The output reveals two different signatures.
The first is located between 14400 and 14500
and the other is located between 14500 and 14600.
The best approach is to handle each signature individually.
We’ll first divide the 14400 to 14500 range
into 10-byte segments, saving the results to a new directory
We’ll then scan these segments
Let’s narrow this down again,
by splitting the 14430-14440 range into one-byte intervals
and save the results to a new directory,
and scan the new directory
Since the byte at offset 14430 of the Meterpreter executable
is part of the ClamAV signature, let’s change it
in an attempt to evade detection.
We’ll use PowerShell to read the bytes of the Meterpreter executable,
zero out the byte at offset 14430,
and write the modified executable to a new file, met_mod.exe
To find out if the modification worked, we’ll repeat the split,
this time on the modified executable,
and then scan it.
As we can see, this did effectively bypass the signature detection.
We succeeded in evading the signature match by modifying a single byte. Nice!
Recalling that another signature was detected in the offset range 14500
to 14600 so we’ll repeat the procedure and locate the first offending byte.
Note that we are now running the split on our modified executable,
which contains our first signature modification.
After several iterations, we discover that the byte at offset 14537
contains the first signature byte.
If we continue following this procedure,
we also find a signature match at offset 73801 that must be evaded.
In this instance, changing the last byte to 0x00 does not produce a clean scan,
but changing it to 0xFF does.
To fully evade the signature scan, we end up with the following PowerShell script.
Again, note that the number of signature detections and offsets may vary.
Performing a final scan of the complete modified Meterpreter executable,
we find that it successful evades detection by ClamAV.
With a fully modified Meterpreter executable that bypasses ClamAV,
we can launch a Metasploit multi/handler,
and execute the malicious binary,
but unfortunately, nothing happens.
We may have successfully bypassed the signature detection,
but we have also destroyed some functionality inside our executable.
Remember that the Meterpreter executable contains the first stage shellcode
and we have likely changed something in either the shellcode itself
or the part of the executable that runs it.
There is only one option to rectify this problem
we must reverse engineer exactly what those three bytes do
and attempt to modify them in such a way that the executable still works.
This can be tedious work,
especially considering that the byte offsets may change
every time we regenerate the Meterpreter executable,
and even though we are bypassing ClamAV,
we may not be bypassing other antivirus products.
To demonstrate this, let’s open File Explorer
and navigate to the folder containing our final met_mod.exe.
If we right-click it, and choose “Scan selected files with Avira”,
we find that Avira does, in fact flag it as malicious.
Ultimately, this technique should work in theory
and it sounds relatively straight-forward,
but is not very effective in the real world, especially considering the fact
that we would still have to contend with heuristic scanning.
Instead of continuing with this approach, in the next section
we will attempt to encode or encrypt the offending code.