TotalTechGeek / DotNetCompressor

Compresses .NET executables and merges dlls into a standalone, smaller executable.
MIT License
51 stars 20 forks source link

Antivirus false positives #6

Open sp00n opened 3 years ago

sp00n commented 3 years ago

This looked promising, but unfortunately several antivirus programs pick up .exes compressed with this tool as malware/trojans/malicious/etc. Probably as it was used by malware authors as well. Unfortunately this basically makes it useless. :(

This is a small exe I just created: image

TotalTechGeek commented 3 years ago

Sorry to hear this :/ While this is one of my most popular modules, it's actually one I never expected to gain any traction 😅

You could try seeing if https://github.com/roachadam/bytepress is able to resolve your immediate search.

On the topic of malware false positives, one could try to modify the mechanism for decompression & evaluation, but I'm not sure if this would yield positive results as the decompress / deobfuscate -> invoke assembly pattern is a common technique used by viruses to try to avoid detection (clearly it doesn't work anymore).

If I adjusted the code, some of the false positives might let up (which is why I recommended bytepress), but the heuristic-based ones would still likely flag this pattern.

I'll consider playing around with it a bit to see if I could get the module functioning again.