In some cases, your executable might get flagged by antivirus,
even though you have encoded the stager and you didn't use
the built‑in executable templates or any of the Metasploit
formats such as exe or exe‑only.
In this case, it might be because your executable file is
showing signs that it might be malicious,
even though no solid signatures can be matched on the file.
When you think about how a malware analyst usually
statically analyzes potentially malicious files,
you will find that he usually checks various characteristics.
Antivirus tries to automate this process by extracting these characteristics
from the file and feeding them to classification models and various
algorithms in an attempt to make a statistical decision about whether or not
the file is indeed malicious. Things which might be a strong indicator that a
file is malicious to a malware analyst will also possibly contribute to the
overall score of a file.
We should therefore pay close attention to these aspects when we craft our
executables. Things to avoid are having too few imports in the import address
table of our executable. A file which doesn't import functionality from the
operating system is a good indicator that it might be obfuscated and that it
may attempt to resolve APIs without the help of the operating system's loader
and dynamic linker.
This is indeed the case when we use MSFvenom to generate the
stager. Adding random and benign APIs to the import address table
could make the file look less suspicious.
Another thing you should avoid is importing frequently‑abused APIs. The
presence of these APIs in the import address table will make your executable
look more dangerous and therefore more likely to get flagged by the
antivirus. You may recall from previous modules where we discussed MSFvenom's
exe and exe‑only format that they both rely on memory sections which have
read/write execute permissions.
The main reason for this is that in the case we choose to use an
encoder, this is required and by design. Therefore, the presence of
read/write execute memory sections will increase the probability that
your executable will be flagged.
Finally, entropy is also something which might be calculated by an antivirus.
Since when we run the stager for an encoder,
we essentially end up with invalid code, which may contain unusual
instructions, which usually do not appear very often in valid code.
There's a good chance that this might be frowned upon by an antivirus,
especially if the code is in the read/write execute
memory section of the executable file.
There are, of course, other characteristics, which will also be taken into
consideration when calculating the final score for a given file, things
such as alternate data streams and, in particular, the mark of the web or
the file's placement on the filesystem,
as well as the permissions on the file may also be considered.
The reason being that a file having been downloaded from the internet
and located in the user's download folder is more likely to be malicious
than a file in the program files directory,
which a regular user could not even write to.
Digital signatures will also be taken into account. Broken
or untrusted signatures are sure to get your executable file
quarantined by the antivirus.