Security Investigate

Exploiting an Antivirus Interface

Download now Free registration required

Executive Summary

The author proposes a technique for defeating signature-based malware detectors by exploiting information disclosed by antivirus interfaces. This information is leveraged to reverse engineer relevant details of the detector's underlying signature database, revealing binary obfuscations that suffice to conceal malware from the detector. Experiments with real malware and antivirus interface on Windows operating systems justifies the effectiveness of the approach.

  • Format: PDF
  • Size: 186.9 KB