|Main Archive Page > Month Archives > metasploit-framework archives|
Well, just thought I'd share my results with NOD after applying the jsidle patch for new icon adobe exploit. Bottom line, NOD still flags it as PDF/Exploit.Gen. Tried encrypting it also and it did cut down on detections but NOD still flags it as PDF/Exploit.Gen.
Seems NOD is doing a pretty good job in flagging malicious PDFs.
--- On Sat, 7/10/10, Jonathan R <firstname.lastname@example.org> wrote:
From: Jonathan R <email@example.com>
To: "Miguel Rios" <firstname.lastname@example.org>, email@example.com
Date: Saturday, July 10, 2010, 11:15 PM
NOD prides themselves on having one of the best heuristics engines, so
I believe NOD would mark the PDF as suspicious and not a specific
threat. You can do what many malware writers do and split the PDF into
multiple parts and you can narrow the range of where/what in the PDF
is getting flagged. Then change things accordingly.
This idea of delaying code to bypass detection has been brought up
before by well known virus writers like Z0mbie and Second Part To
http://vxheavens.com/lib/vzo23.html <--- Z0mbie's Paper
http://www.hack0wn.com/view.php?xroot=72.0&cat=papers <--- SPTH/rHlf
This is all based upon the fact that a anti virus like Norton or NOD
can only spend about 3 or 4 seconds on each file. Otherwise a AV scan
would take to long.