3 ms·

> evades detection simply by counting the number of documents – or the lack thereof – that reside on a PC and not executing if a certain number are not present.

> evades detection simply by counting the number of documents – or the lack thereof – that reside on a PC and not executing if a certain number are not present. This is so simple, it's a one line trick: Public Function DKTxHE() As Boolean DKTxHE = RecentFiles.Count < 3 End Function > the typical lack of documents in a ... test environment make it easy ... for malware authors to fly under the radar Dev environment is dissimilar to prod --> works in dev but not prod. Surprise, surprise. Original blog: https://sentinelone.com/blogs/anti-vm-tricks/ https://sentinelone.com/blogs/anti-vm-tricks/

throwaway5752 10y ago
This is not novel, it's same general technique on a much more simplistic level as those that red pill uses. edit: I don't really care about the downvote, but would have preferred a reply as to how it is that fundamentally different from silly stuff like checking device names, or even checking IDT location/ITLB contents/timing attacks This is clever-ish userspace stuff, but it's the same general idea and it's not new.
13of40 10y ago
The funny thing about these is that the obfuscator leaves a billion clues that can tip you off that the macro is malicious, without even having to run it. Any human being can tell you that DKTxHE is a bogus name for a function, so the only trick is to implement that detection in code...
- jstanley 10y ago
  > the only trick is to implement that detection in code String entropy scoring works surprisingly well for problems like this: build a corpus of function names (scrape it from github?), generate a markov model, see how probable the candidate function name is according to the markov model.
  - Senji 10y ago
    Then I'll just run a prettifyer with the same sample data and name functions in my malicious macros from that.
    - jstanley 10y ago
      Like a lot of things, it's an arms race. For the most part people aren't doing that yet because it's easier, and almost as effective, to just generate them at random.
- robryk 10y ago
  > Any human being can tell you that DKTxHE is a bogus name for a function, so the only trick is to implement that detection in code... Don't people run code obfuscators on macros?

throwaway5752 10y ago

This is not novel, it's same general technique on a much more simplistic level as those that red pill uses. edit: I don't really care about the downvote, but would have preferred a reply as to how it is that fundamentally different from silly stuff like checking device names, or even checking IDT location/ITLB contents/timing attacks This is clever-ish userspace stuff, but it's the same general idea and it's not new.

13of40 10y ago

The funny thing about these is that the obfuscator leaves a billion clues that can tip you off that the macro is malicious, without even having to run it. Any human being can tell you that DKTxHE is a bogus name for a function, so the only trick is to implement that detection in code...

jstanley 10y ago
> the only trick is to implement that detection in code String entropy scoring works surprisingly well for problems like this: build a corpus of function names (scrape it from github?), generate a markov model, see how probable the candidate function name is according to the markov model.
- Senji 10y ago
  Then I'll just run a prettifyer with the same sample data and name functions in my malicious macros from that.
  - jstanley 10y ago
    Like a lot of things, it's an arms race. For the most part people aren't doing that yet because it's easier, and almost as effective, to just generate them at random.
robryk 10y ago
> Any human being can tell you that DKTxHE is a bogus name for a function, so the only trick is to implement that detection in code... Don't people run code obfuscators on macros?