Antivirus Bypass part 2

Hello friends. In my previous article, I introduced you to the basics of Hexing to bypass antivirus detection. As a reference to that post, I am writing this article to inform you about how Hexing is actually done using Dsplit. Dsplit is a software used to detect virus signature. Hexing is very much important for us to evade antivirus detection. If you will learn how to bypass antivirus by Hexing, you don't have to search for FUD keyloggers and trojans. You can hex files to make them FUD.

Downloads:

I will be using Dsplit as virus signature detector and Ice Gold Freezer as virus over here. You can use any other virus containing file you want.

Download these two files over here:
1. Avira antivirus (Because I've used it in tute).
2. Ice Gold Freezer and Dsplit.exe program (used for detecting virus signature).

The downloaded file is zipped and password protected. Click here to get the password.

Hexing Ice Gold Freezer using Dsplit:

First of all, let me tell you that Ice Gold Freezer is detected as "SPR/Tool.Freezer.8" virus (actually malware as Avira.com says) by my Avira antivirus which I use on my computer
. So, I will be telling you how to bypass Avira detection for Ice Gold Freezer. So, lets start.

1. Download Avira antivirus, Dsplit and Ice Gold Freezer from links provided above. Extract Dsplit folder to desktop.

3. Scan Ice Gold Freezer.exe file you've downloaded with antivirus. My Avira says its "SPR/Tool.Freezer.8" malware. So, lets work on it.

4. Copy IceGoldFreezer.exe to Dsplit folder.

5. Now, open Command Prompt (Start ->Run -> cmd ->OK). Change directory to Dsplit folder. So, enter

cd "Replace with your path to Dsplit folder"

and hit Enter.

eg: Say I have saved Dsplit on desktop and have path to Dsplit folder as:

C:\Users\RAJ\Desktop\DSplit-0.2

In above path, RAJ is my user account name. So, to change directory to Dsplit folder, I will enter:

cd C:\Users\RAJ\Desktop\DSplit-0.2

in command prompt so that control will be passed to Dsplit.

So, find out your path and enter it accordingly. You can refer first line in the command prompt image below for more information.

6. Now, type in this command:
dsplit.exe 0 max 1000 IceGoldFreezer.exe

and hit Enter.

                                                  Click on image to see enlarged view

What does this command means?? Simple. Dsplit is command line software and requires this command for its running. The meaning of command:

dsplit.exe startbyte endbyte numberofbytesinbetween target

7. Now, Dsplit.exe will create around 234 files in current directory. Now, scan all these 234 files created with Avira antivirus. Avira will detect all files from 8000.exe to 233472.exe as virus. So, there is something (virus signature) in 8000.exe which is not present in 7000.exe. Thus, 7000.exe lacks virus signature and hence not detected by Avira, while 8000.exe has virus signature.

                                              Click on image to see enlarged view


Delete all files except 7000.exe, 8000.exe, Dsplit.exe and original IceGoldFreezer.exe.

8. Move on to command prompt and type this:
dsplit.exe 7000 8000 100 IceGoldFreezer.exe

and you'll get 10 files created in current directory. Scan all these 10 created files with Avira antivirus. Avira will detect all files except 7000, 7100.exe as virus. So, again we can say that there is something (actually virus signature) in 7200.exe which is not present in 7100.exe. Delete all files except 7100, 7200, Dsplit.exe and IceGoldFreezer.exe.

9. Now, type in command prompt:
dsplit.exe 7100 7200 10 IceGoldFreezer.exe

                                                Click on image to see enlarged view


and you'll get 10 new files created in current directory. Scan all 10 files with avira and avira will give all files except 7100.exe as virus. So, 7110.exe contains virus signature which 7100.exe doesn't have.

10. Now, comes the last step. Type in command prompt:
dsplit.exe 7100 7110 1 IceGoldFreezer.exe

Again scan all 10 files created with avira antivirus and avira will detect 7108, 7109 and 7110.exe as virus. So, 7108.exe contains virus signature which 7107.exe lacks. Since, these two files are just 1 byte different, this different 1 byte is actually the virus signature which is detected by Avira.

So, we have to change this one byte contained in 7108.exe to make it UD from Avira. We can change this using a Hex editor which I will explain have explained in my next article Hexing Part III. If you have any problem in using Dsplit to detect virus signature, please mention it in comments section.