Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Antivirus false positives #6

Open
sp00n opened this issue Apr 14, 2021 · 1 comment
Open

Antivirus false positives #6

sp00n opened this issue Apr 14, 2021 · 1 comment

Comments

@sp00n
Copy link

sp00n commented Apr 14, 2021

This looked promising, but unfortunately several antivirus programs pick up .exes compressed with this tool as malware/trojans/malicious/etc. Probably as it was used by malware authors as well. Unfortunately this basically makes it useless. :(

This is a small exe I just created:
image

@TotalTechGeek
Copy link
Owner

Sorry to hear this :/
While this is one of my most popular modules, it's actually one I never expected to gain any traction 😅

You could try seeing if https://github.com/roachadam/bytepress is able to resolve your immediate search.

On the topic of malware false positives, one could try to modify the mechanism for decompression & evaluation, but I'm not sure if this would yield positive results as the decompress / deobfuscate -> invoke assembly pattern is a common technique used by viruses to try to avoid detection (clearly it doesn't work anymore).

If I adjusted the code, some of the false positives might let up (which is why I recommended bytepress), but the heuristic-based ones would still likely flag this pattern.

I'll consider playing around with it a bit to see if I could get the module functioning again.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants