Messing with Our Behavior
As previously mentioned, most antivirus products implement heuristic
detection techniques that simulate the execution of the file.
This behavior analysis is performed in addition to standard signature detection,
so in this section we must bypass both techniques.
The typical way to bypass a heuristics scan is to make the malware or stager
perform some actions that will execute differently when emulated
rather than when they are actually executed on the client.
If we determine that our code is being run in a simulator,
we can simply exit the program without executing potentially suspect code.
Otherwise, if the program is executing on the client, we can execute our intended
code, safe from the antivirus program’s heuristic detection routine.