Simple Sleep Timers
If an application is running in a simulator and the heuristics engine
encounters a pause or sleep instruction, it will “fast forward”
through the delay to the point that the application resumes its actions.
This avoids a potentially long wait time during a heuristics scan.
One simple way to take advantage of this is with the Win32 Sleep API,
which suspends the execution of the calling thread
for the amount of time specified.
If this section of code is being simulated, the emulator will detect the
Sleep call and fast-forward through the instruction.
If our program observes the time of day before and after the Sleep call,
we can easily determine if the call was fast-forwarded.
For example, we can inject a two-second delay,
and if the time checks indicate that two seconds have not passed
during the instruction, we assume we are running in a simulator
and can simply exit before any suspect code is run.
Let’s try this out.
We’ll reuse the original unencrypted C# shellcode runner
and insert Sleep into the Main method to detect the time lapse.
To do so we must also include the pinvoke import statement for "Sleep"
In this code, we use the DateTime object and its associated Now method
to fetch the local computer’s current date and time.
To determine the elapsed time, we use the Subtract method
and convert this into seconds with the TotalSeconds property.
Next, we try to determine if the Sleep call has been emulated
by inspecting the time lapse.
In this case, we are testing for a lapse of 1.5 seconds
to allow for inaccuracies in the time measurement.
If the time lapse is less than 1.5 seconds we can assume the call was emulated
and simply exit instead of executing shellcode.
After compiling the C# project,
we’ll submit the executable to AntiScan.Me.
11 products flagged the C# shellcode runner,
which is the same detection rate as the original.
The detection rate is identical due to signature detections, so the next step
is to combine the encrypted shellcode with the time-lapse detection.
We can reuse the Caesar cipher along with the Sleep function
to attempt a bypass of both detection mechanisms.
By inserting the Sleep call and the time- lapse detection into the Caesar ciphered
C# shellcode runner project, we have combined both techniques.
Performing a scan with the compiled executable yields an interesting result
This time, only six products flagged our code
This is a huge improvement as we have bypassed Windows Defender detection,
which is installed by default on most modern Windows-based systems.
This improved evasion is rather surprising considering the Sleep function
has been used for behavior evasion for more than a decade.
We are very close to evading all the antivirus products
supported by AntiScan.Me,
so in the next section, we’ll move on to other heuristic bypass techniques.