3 ms·
In my experience, most of these "cloud/advanced/ai" anti-virus tools will tag your executables if you use common open source packers (upx) or open source obfusc
by eyegor 4y ago
In my experience, most of these "cloud/advanced/ai" anti-virus tools will tag your executables if you use common open source packers (upx) or open source obfuscators. Using less common tools generally doesn't raise red flags (???), but you can often trick them into being okay with packed code if you sign it with an EV cert.
- skissane 4y agoI had a Powershell script embedded in an executable I wrote in C. It launched Powershell as a sub-process and piped the script into standard input. Windows Defender thought my executable was some trojan (something like trojan:Win32/Wacatac.B!ml). So I gzipped the script as part of the build process, embedded the gzipped script instead, along with a single file decompression library, and decompressed it at runtime - now Windows Defender is okay with my program. Gosh, if I can do that, some malware author can too. If these “heuristic” detections are so easy to bypass, what’s the point?
- elcritch 4y agoTo mark a checkbox on some security compliance form somewhere.