Open sp00n opened 3 years ago
Sorry to hear this :/ While this is one of my most popular modules, it's actually one I never expected to gain any traction 😅
You could try seeing if https://github.com/roachadam/bytepress is able to resolve your immediate search.
On the topic of malware false positives, one could try to modify the mechanism for decompression & evaluation, but I'm not sure if this would yield positive results as the decompress / deobfuscate -> invoke assembly pattern is a common technique used by viruses to try to avoid detection (clearly it doesn't work anymore).
If I adjusted the code, some of the false positives might let up (which is why I recommended bytepress), but the heuristic-based ones would still likely flag this pattern.
I'll consider playing around with it a bit to see if I could get the module functioning again.
This looked promising, but unfortunately several antivirus programs pick up
.exe
s compressed with this tool as malware/trojans/malicious/etc. Probably as it was used by malware authors as well. Unfortunately this basically makes it useless. :(This is a small exe I just created:![image](https://user-images.githubusercontent.com/758857/114729603-6d2c0000-9d40-11eb-8f54-a96e784a6580.png)