Beefy Boxes and Bandwidth Generously Provided by pair Networks
Your skill will accomplish
what the force of many cannot
 
PerlMonks  

Re: PAR::Packer generated EXE that was detected as a trojan...

by Anonymous Monk
on Sep 15, 2018 at 00:29 UTC ( [id://1222406]=note: print w/replies, xml ) Need Help??


in reply to PAR::Packer generated EXE that was detected as a trojan...

What other thing could I do to bypass this issue? I don't think that PAR::Packer is generating a "corrupted" EXE, at least I suppose that my WinXP VM is not infected and PAR is being an inocent victim of it.

Send the file to windows defender software team, tell'em it has no virus, they'll figure out the false positive, update their stuff, so its no longer detected as a false positive

  • Comment on Re: PAR::Packer generated EXE that was detected as a trojan...

Replies are listed 'Best First'.
Re^2: PAR::Packer generated EXE that was detected as a trojan...
by vitoco (Hermit) on Sep 15, 2018 at 01:07 UTC

    Thanks for the idea, but I'll do first some tests by "compiling" some other random scripts from myself to see if this persists. My program is WIP and it will continue changing during the following weeks.

      Unfortunately, the EXE for every perl script I provided was detected as a virus by the other system. Even an empty file!!!

      The next step is to try a fresh strawberry perl installation on another fresh VM. Probably my WinXP was infected, because I recall that I used it as a honeypot years ago.

        "Probably my WinXP was infected, because I recall that I used it as a honeypot years ago."

        Yikes, not a good idea to develop on a system lime that :p

        I work in security and have found pp par packed files that drop bitcoin and monero miners as well as a remote access trojan. The user created perl script is extractable and benign and the malicious code appears to resided somewhere outside of the user script, although I've not identified specifically where yet. The source is most likely the packer, so recommendation is to check the source of your packer as there may be malicious versions in the wild that insert malicious code into your compiled perl executables. Note, the code is highly resistant to sanbox analysis and carries out a good deal of VM enumeration so YMMV in getting it to run and do malicious things outside of bare metal execution.

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://1222406]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others admiring the Monastery: (5)
As of 2024-04-18 05:55 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found