Book Review: Antivirus Bypass Techniques

This is the review of Antivirus Bypass Techniques book.

(My) Conclusion

This book is a niche subject book, to be more precise it’s about a niche tool (antivirus) used in a niche domain (endpoint security) of cybersecurity.

As his name implies, it describes how antivirus products are working and different technique to evade this antivirus products.

The book it’is not very technical (compared with a programming book) but it implies some knowledge of Windows OS architecture, Assembler and Python.

If you are new to this subject (like myself) it’s very good introduction that will give you a rather technical glimpse of the mouse and cat “game” played between the antivirus developers and malware creators.

If you are already working in the endpoint security domain you (probably) already know all the techniques presented in the book.

1.Introduction to the Security Landscape

This chapter is exploring the following topics:

  • definition of different malware types:
    • Virus: A malware type that replicates itself in the system.
    • Worm: A type of malware whose purpose is to spread throughout a network and
      infect computers connected to that network.
    • Rootkit: A type of malware that is found in lower levels of the operating system that
      tend to be highly privileged.
    • Downloader: A type of malware whose function is to download and run from the
      internet some other malicious files.
    • Ransomware: A type of malware whose purpose is to encrypt computer files and
      demand financial ransom from the user before they can access their files.
    • Botnet: Botnet malware causes the user to be a small part of a large network of
      infected computers.
    • Backdoor: A type of malware whose purpose is  to leave open a “back door”, providing the attacker with ongoing access to the user’s computer.
    • PUP: An acronym that stands for potentially unwanted program, a name that
      includes malware whose purpose is to present undesirable content to the user, for
      instance, ads.
    • Dropper: A type of malware whose purpose is to “drop” a component of itself into
      the hard drive.
    • Scareware: A type of malware that presents false data about the computer it is
      installed on, so as to frighten the user into performing actions that could be
      malicious, such as installing fake antivirus software or even paying money for it.
    • Trojan: A type of malware that performs as if it were a legitimate, innocent
      application within the operating system.
    • Spyware: A type of malware whose purpose is to spy on the user and steal their
      information to sell it for financial gain.
  • definition of different protection system types:
    • EDR (Endpoint Detection and Response): The purpose of EDR systems is to protect the business user from malware
      attacks through real-time response to any type of event defined as malicious.
    • Firewall: A system for monitoring, blocking, and identification of network-based
      threats, based on a pre-defined policy.
    • IDS/IPS (Intrusion Detection and Protection System): IDS and IPS provide network-level security, based on generic signatures, which inspects network packets and searches for malicious patterns or malicious flow.
    • DLP (Data Loss Prevention): DLP’s sole purpose is to stop and report on sensitive data exfiltrated from the organization, whether on portable media (thumb drive/disk on key), email, uploading to a file server, or more.
  • the basics of an antivirus product. Most of the antivirus products have different types of engines:
    • static engine: Conducts comparisons of existing files within the operating system against a database of signatures, and in this way can identify malware.
    • dynamic engine: Is checking the files at runtime using API monitoring (the goal of API monitoring is to intercept API calls in the operating system and to detect the malicious ones) and sand-boxing (A sandbox is a virtual environment that is separated from the memory of the physical host computer. This allows the detection and analysis of malicious software by executing it within a virtual environment)
    • heuristic engine: This type of engine determines a score for each file by conducting a statistical analysis that combines the static and dynamic engine methodologies.
    • unpacker engine: Unpacking is the process of restoring the original malware code; the malicious code was “packed” in order to hide a malicious patterns and thus thwart
      signature-based detection. The unpacker engine is able to detect if a file contains a (known) unpacker code.

2.Before Research Begins

In order to evade the antivirus products you must have a good understanding about how the different antivirus program components are working. The authors are using different tools (on Windows OS only) that usually are used for malware analysis to discover the working mechanics of the AVG Antivirus.

The authors are using the following tools :

  • Process Explorer is a tool that will will provide us with a lot of relevant information about the processes that are running in the operating system like the file name of the processes, the percentage of the CPU resources for the processes, the amount of memory and RAM allocated to the processes. Using the Process Explorer it is possible for example to find the hook that are used by the antivirus software to conduct monitoring on every process that exists within the operating system. This hook is usually a DLL file that is injected into every process running within the operating system
  • Process Monitor is a tool that can be used to observe the behavior of each process in the operating system from the moment when are started until the moment are closed. Using the Process Monitor is possible for example to find the processes used by the antivirus software for specific tasks like scanning a specific file.
  • Autoruns is a tool that shows what programs are configured to run during system bootup or login, and when you start various built-in Windows applications. With Autoruns is possible to use filters to find for example all the antivirus software files that are loaded at the startup of the operating system.
  • Regshot is an open source tool that lets you take a snapshot of your registry, then compare two registry shots, before and after installing a program. In this case it is used to find all the registry changes that took place after installing the antivirus software

3.Antivirus Research Approaches

The authors are proposing two methods to bypass the  antivirus software:

  • Find and exploit a vulnerability in the antivirus software
  • Find and use a detection bypass method

This chapter gives a few details about the first method; basically it presents a few vulnerabilities on different antivirus software packages that had impact on the way the antivirus was functioning:

  • Insufficient permissions on the static signature file. The file containing static signature had insufficient permissions meaning that any low-privileged user could modify the content of the file.
  • Unquoted service path. When a service is created within the Windows operating system and the executable path contains spaces and the path is not enclosed within quotation marks, the service will be susceptible to an Unquoted Service Path vulnerability.
    To exploit this vulnerability, an executable file must be created in a particular location in the service’s executable path, and instead of starting up the antivirus service, the service we created previously will load first and cause the antivirus to not load during operating system startup
  • DLL hijaking. When software wants to load a particular DLL, it uses the LoadLibraryW() Windows API call. It passes as a parameter to this function the name of the DLL it wishes to load. It is not recommended to use the LoadLibrary() function, due to the fact that it is
    possible to replace the original DLL with another one that has the same name, and in that
    way to cause the program to run our DLL instead of the originally intended DLL.

If you are interested of other types of vulnerabilities linked to the antivirus products you can look into the CVE MITRE database using the keyword antivirus.

4.Bypassing the Dynamic Engine

As explained in the first chapter the dynamic engine is checking the runtime behavior of files using API monitoring and sand-boxing. The authors are presenting two types of techniques for bypassing the dynamic engine:

 Bypass using process Injection

Process injection goal is to inject a piece of code into the process memory address space of another process, give this memory address space
execution permissions, and then execute the injected code. The general steps of a process injection are:

  1. Identify a target process.
  2. Receive a handle for the targeted process to access its process address space.
  3. Allocate a virtual memory address space where the code will be injected and
    executed, and assign an execution flag if needed.
  4. Perform code injection into the allocated memory address space of the targeted
  5. Execute the injected code.

The authors are presenting three process injections techniques; there are a lot more techniques, for a non-exhaustive list you can check MITRE Pricess Injection Techniques :

  • DLL Injection DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL).
  • Process hollowing Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code.
  • Process doppelganging This technique is using the Windows Transactional NTFS (TxF) API. TxF was introduced in Vista as a method to perform safe file operations.To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. Adversaries may abuse TxF for replacing the memory of a legitimate process, enabling the veiled execution of malicious code.

Bypass using timing-based techniques

Timing based techniques are based on the fact that antivirus vendors prefer to scan about 100,000 files in 24 minutes, with a detection rate of about 70%, over scanning the same number of files in 24 hours, with a detection rate of around 95%.

The first technique will utilize Windows API calls that cause the delay of the malware functionality, so the dynamic engine will not be able to spot the malware because it is not executed in a timely manner. A basic technique to  implement this behavior is by using the sleep() function combined with the GetTickCount() function.

The usage of the sleep() function only can be detected by the antivirus static engine and then antivirus emulator (used by dynamic engine) will simulate the pass of the sleep time thus bypassing the malware defense mechanism. The  usage of GetTickCount() (which returns the amount of time the operating system has been up and running) will counter this (time forward) emulation because the malware will be able to detect it.

The second technique is named by the authors the memory bombing and take advantage of the limited time that antivirus software has to dedicate to each individual file during scanning.

The pseudo-code for this technique looks like:

int main(){
char *memory_bombing = NULL;

//Initialize the memory_bombing variable with a bunch of
//At this point, the antivirus is struggling to scan the
//file and forfeits

memory_bombing = (char *) calloc(200000000, sizeof(char));

if(memory_bombing != NULL) {
//free the memory allocated to memory_bombing
return 0;

The logic behind this type of bypass technique relies on the dynamic antivirus engine
scanning for malicious code in newly spawned processes by allocating virtual memory so
that the executed process can be scanned for malicious code in a sandboxed environment.
The allocated memory is limited because antivirus engines do not want to impact the user
experience so if the antivirus engine have to allocate a large amount of memory the antivirus engines will not scan the file.

5.Bypassing the Static Engine

The static engine is using file signatures to spot malicious files so, a lot of antiv-viruses are embedding the YARA tool; the chapter contains also a small introduction to YARA templates.

There are three ways to by pass the static engine:

    • Code Obfuscation is the process of making applications difficult or impossible to de-compile or disassemble, and make the application code more difficult to parse. The code obfuscation could defeat the ARA templates which are looking for specific strings into the files.
    • Encryption In this case the malicious functionality of the malware will be encrypted and appear as a harmless piece of code , meaning the antivirus software will treat it as such and will allow the malware to successfully run on the system.
      But before malware starts to execute its malicious functionality, it needs to decrypt its
      code within runtime memory. Only after the malware decrypts itself will the code be
      ready to begin its malicious actions. There are different encryption techniques used by the malwares:
      • Oligomorphic code includes several decryptors that malware can use. Each time it runs on the system, it randomly chooses a different decryptor to decrypt itself.
      • Polymorphic code mostly uses a polymorphic engine that usually has two roles. The first role is choosing which decryptor to use, and the second role is loading the relevant source code so that the encrypted code will match the selected decryptor.
      • Metamorphic code is code whose goal is to change the content of malware each time it runs, thus causing itself to mutate.
    • Packing A packer is a tool used to mask a malicious file. In general, packers work by taking an EXE file and obfuscating and compressing the code section (“.text” section) using a predefined algorithm. Following this, packers add a region in the file referred to as a stub, whose purpose is to unpack the software or malware in the operating system’s runtime memory and transfer the execution to the original entry point (OEP). The OEP is the entry point that was originally defined as the start of program execution before packing took place.The authors are presenting how the UPX and AsPAck packers are packaging a file and how unpacker will have to work in order to detect the content of the original file.

6.Other Antivirus Bypass Techniques

This chapter presents other bypass techniques:

  • Binary patching: It consists in opening/executing a binary through a debugger (the x32dbg/x64dbg in the book example), changing (on the fly) some code and then re-generating a new binary using the “Patch File” functionality of the debugger. This technique would defeat the static engine.
  • Timestomping; It consists in changing some metadata of a binary file like the created date. This relies on the fact that the creation date could be used for computing static signatures of different files so changing the creation date could defeat a static engine.
  • Junk code. Technique very similar to the Code Obfuscation technique presented in the chapter 5 Bypassing the static engine. The Junk code technique could also add empty functions, or loading non-existing files that could confuse the dynamic engine.
  • PowerShell. It consists in executing a payload directly from powershell; The powershell binary being a trusted file then the dynamic engine might be bypassed. 
  • Single malicious functionality If the static and the dynamic engine are not able to decide if a file is malicious then the heuristic engine will try to compute a score for the scanned file. The heuristic engine have a detection threshold under which a scanned file will not be marked as malicious even if it contains some potentially malicious components. The goal for the malware developer/s is to find the maximum number of malicious actions that will be under the detection threshold of the heuristic engine. 

7.Antivirus Bypass Techniques in Red Team Operations

This chapter is for me rather badly named; it starts by explaining what are the responsibilities and the goals of a red team and how it use the techniques presented into this book in the context of pen tests.

But, the main part if the chapter presents how a malware can check what antivirus products are installed on the endpoints that it wants to attack in order to apply the right bypass techniques, action that the authors are calling the fingerprinting of the antivirus software.

Antivirus fingerprinting can be done based on identifiable constants, such as the following:  Service names (for example, WinDefend is for example the service name for Microsoft Defender), Process names (or example, AVGSvc.exe is the process name of the AVG antivirus), Domain names, Registry keys or Filesystem artifacts.

The authors are recommending the following GitHub repository ethereal-vx/Antivirus-Artifacts  to find more details about Antivirus fingerprinting

8.Best Practices and Recommendations

The last chapter of the book can be split in 2 parts. The first part presents some controls that the antivirus providers could implement in order to mitigate some (not all of them) of the bypass techniques presented in previous chapters.

To mitigate the DLL hijacking vulnerability (a DLL is loaded using his name; see chapter 3 for more explanations) a proper mechanism to validate the loaded DLL module should be implemented. This validation should use not only the DLL name but also by a certificate and a signature.

To mitigate the Unquoted service path vulnerability (an executable path contains spaces and the path is not enclosed within quotation marks; see chapter 3 for more explanation) the solution is simply to wrap quotation marks around the executable path of the service.

For improving the antivirus detection the authors are proposing to use “dynamic” YARA. The goal of the “dynamic” YARA is to scan for potentially malicious strings and code at the memory level, on a dumped memory snapshot. Normally YARA is used by the static engine for file signature but in the case of “dynamic” YARA the template engine is used to look at the memory where the malware has been already de-obfuscated, unpacked, and decrypted.

Another best practice consists in the usage of Antimalware Scan Interface (AMSI) by the application developers.Windows Antimalware Scan Interface (AMSI) is an API that allows custom applications and services to integrate with any antimalware product that’s present on a machine.

The second part of the chapter contains some secure coding recommendations which can be applicable in SDLC of any type of software: Do not use old code, Input validation (of the AntiVirus UI), Read and fix the compiler warnings, Automated code testing, Use integrity validation for the static signature files download.


Une radiographie de la cybercriminalité roumaine

Présentation du sujet

La présentation se propose d’offrir « Une radiographie de la cybercriminalité roumaine » et a deux objectifs principaux

  •  Tout d’abord, trouver des chiffres et des statistiques concernant la cybercriminalité roumaine.
  •  Deuxièmement, faire une liste la plus exhaustive possible des domaines de la cybercriminalité dans lesquels la criminalité roumaine est plus spécialisée.

Un troisième but qui résume et résulte de l’aboutissement des deux premiers  serait de faire une distinction très claire  entre le mythe qui entoure la cybercriminalité (qui est surtout créé et entretenu pas la presse) et la réalité  de la cybercriminalité.

La géographie de la veille

Concernant l’axe temporel, la veille a été amorcée au cours du mois d’avril 2012 avec des premiers résultats concluants vers mi-mai 2012.  Le processus de veille a été arrêté le 1er juillet 2012.

D’un point de vue géographique, la veille concerne uniquement la cybercriminalité provenant de Roumanie, mais sans distinction de la provenance géographique  des victimes. Il n’y a donc pas de limites géographiques en ce qui concerne les victimes.


Les mots clés

Le tableau suivant synthétise les informations concernant les mots clés utilisés pour la veille :

Mots clés Efficacité Commentaire
romanian cyber criminality statistics   Très bonne
statistici cibercriminalitate romana  Très bonne Ces mots clés sont en langue roumaine
romanian cybercriminal statistics   Bonne
formes cybercriminalité  Bonne
types d’attaques cybercriminalité roumaine  Faible
Statistiques cyberdélits  Faible

Figure 1. Les mots clés de la veille

Dans la recherche des synonymes pour les mots clés on a utilisé l’outil Touchgraph qui à la base est un outil de cartographie. Ainsi qu’il résulte de l’image suivante, l’outil Touchagraph  présente pour chaque recherche, des recherches associées (« Related Searches »). Parmi ces recherches associées on peut parfois trouver des synonymes pour les mots clés de la recherche d’origine.

Figure 2. Recherches associées a des mots clés calculés par Touchgraph
Figure 2. Recherches associées a des mots clés calculés par Touchgraph

La veille manuelle

Les moteurs de recherches utilisés  pour la veille sont les suivants :

  • Google (,,, – donne des résultats très pertinents et en plus il a des fonctionnalités  qui facilitent le travail de l’utilisateur, tel que l’aperçu des pages (voir Figure 2)
  • Bing – donne des résultats presque aussi bons que Google, mais il n’a pas toutes les fonctionnalités supplémentaires de Google
  • Yahoo – donne des résultats moins bons que les deux précédents moteurs
  • Exalead – donne des résultats plutôt mitigés donc, ce moteur n’as pas été retenu dans notre veille technologique.

Figure 3. L’aperçu des pages dans le moteur Google.
Figure 3. L’aperçu des pages dans le moteur Google.

La veille automatique

Une fois les mots clés identifiés, l’étape suivante a été de mettre en place une veille automatique.

Pour la veille automatique les outils suivants on été utilisés :

  • Google Alerts (voir Figure 4) – très bon outil gratuit qui s’intègre assez bien avec d’autres outils de Google (Gmail, iGoogle). Le nombre d ‘alertes est illimité et l’outil offre la possibilité de recevoir les alertes par email ou  par un flux RSS (qui donc peut être ajouté a n’importe quel outil d’agrégation comme iGoogle ou Netvibes).
  • Alerti –  l’outil offre des fonctionnalités comme des rapports, des tâches   liées à chaque élément d’une alerte, l’archivage des alertes mais tous ces fonctionnalités sont payantes. Alerti cherche les mots clés dans les blogs (n’est pas spécifié quels plateformes de blogs), dans des forums (aussi, sans spécifier quels sont les forums), sur Twitter, sur Facebook et d’autres réseaux sociales (sans indiquer lesquels). L’offre gratuite d’Alerti contient une seule alerte sans toutes les autres fonctionnalités.
  • TweetBeep – « TweetBeep is like Google Alerts for Twitter» outil qui fait des recherches par mots clés sur Tweeter. La version gratuite limite le nombre d’alertes a 5.
  • WatchThatPage – une fois que la veille a donné quelques sites ou pages web intéressantes, on a mis en place des outils de surveillance de ces pages web pour être alerté de la moindre modification. Pour cette tache le meilleur outil s’est avéré d’être L’outil permet de surveiller les pages web ciblées et rapporte leurs modifications par email (voir Figure 5).
  • Wysigot – est un outil similaire à WatchThatPage qui en plus est capable d’aspirer le contenu d’une page web. Malheureusement, pour pouvoir l’utiliser il faut installer l’application Wysigot sur une machine, ce qui n’est pas très pratique, contrairement a WatchThatPage qui est une application web.

Figure 4. Le page de Google Alerts pour notre veille
Figure 4. Le page de Google Alerts pour notre veille

Figure 5. La page de WathcThatPage pour notre veille
Figure 5. La page de WathcThatPage pour notre veille

La veille cartographique

Pour la veille cartographique les outils suivants on été utilisées :

  • Touchgraph – l’outil permet de faire une cartographie des mots clés et de vérifier le rayonnement des ces mots clés utilisés.   Pour notre veille on a essayé la version gratuite Touchgraph (appelée Touchgraph SEO).  Touchpraph n’as pas donné des résultats probants et il n’a pas été retenu pour la suite de notre veille.
  • PearlTree – est un outil qui a comme but de donner à l’utilisateur la possibilité d’organiser les pages web préférées sous forme des feuilles d’un arbre (appelé « pearl »). Les pearls peuvent être partagées avec d’autres utilisateurs et aussi stockées ensemble sous forme des arbres (appelé «pearlTree»s). L’outil PerlTree est beaucoup plus versatile et facile d’utilisation que Touchgraph. L’arbre de notre veille peux être accédé de façon gratuite a l’adresse suivante :

Figure 6. L'arbre PearlTree pour notre veille
Figure 6. L’arbre PearlTree pour notre veille


Les chiffres de la cybercriminalité roumaine

La veille de la cybercriminalité roumaine a permis de collecter quelques liens intéressants qui contiennent des données assez précises.

Lien Auteur Commentaire Prix Ministère de l’Intérieur Roumain Des rapports annuels sur plusieurs domaines : sûreté de l’État, lutte contre le trafiques des drogues, criminalité économique, criminalité informatique 0 IC3 (Internet Crime Compliant Center) Organisation crée par le FBI et le NW3C (National White Collar Crime Center)  pour recevoir les plaintes concernant les fraudes sur Internet. 0 Eurostat Eurostat est l’Office statistique de l’Union européenne. Pour l’instant Eurostat ne propose pas des statistiques sur la cybercriminalité mais il devrait le faire dans  le futur. 0

Figure 7. Les liens le plus pertinents de la veille

Les figures suivantes présentent de façon graphique les données trouvées lors de la veille :

Le graphique suivant représente les officielles chiffres de la cybercriminalité roumaine telle que communiquées par le ministère de l’intérieur roumain.

Figure 8. Chiffres de la cybercriminalité roumaine
Figure 8. Chiffres de la cybercriminalité roumaine

L’organisation IC3 maintiens un classement des (10) états a partir desquels les attaques informatiques sont perpétrées.  Comme visible dans la figure suivante, la Roumanie est sortie de ce classement au cours de l’année 2009.

Figure 9. La Roumanie dans le classement américain des états voyous
Figure 9. La Roumanie dans le classement américain des états voyous

Analyse et synthèse

Le sujet lui-même reste très délicat à traiter de façon complète et claire pour des multiples raisons :

  • Par définition, les chiffres fournis correspondent uniquement aux cas avérés et connus de piratage et donc ne représentent que la face visible de la cybercriminalité.
  • Les particuliers ne déposent pas toujours plainte auprès des organes compétents.
  • Les sociétés victimes ne veulent pas qu’on sache que leur sécurité a été compromise, même si la loi les y oblige (aux Etats-Unis d’Amérique et bientôt en Europe aussi) pour des raisons commerciales, d’image de marque, etc…


Valeur1-bon10-mauvais Lien Date Mot clés utilisées
10 25/04/2012 romanian cybercrime
9 27/04/2012 Romania cybercrime
10 27/04/2012 Romania cybercrime
10 27/04/2012 Romania cybercrime
5 28/04/2012 Romania cybercrime
1 29/04/2012 romanian cyber criminality statistics
6 08/05/2012 romanian cybercriminal statistics
7 10/05/2012 Romania cybercrime
8 20/05/2012 Romanian cybercrime
9 20/05/2012 cybercriminalité roumanie
4 10/06/2012 Romanian cybercrime
1 12/06/2012 statistici cibercriminalitate romana
10 12/06/2012 Cybercrime romania
7,0,4383016.story 12/06/2012 Romania cybercrime
3 16/06/2012 cybercriminalité roumanie
7 16/06/2012 cybercriminalité roumanie
3 20/06/2012 romanian cybercriminal statistics
5 25/06/2012 Romanian cybercrime
3 27/06/2012 romanian cyber criminality statistics