Hacker News Reader

Comment by nighthawk454 | Hacker News Reader

> evades detection simply by counting the number of documents – or the lack thereof – that reside on a PC and not executing if a certain number are not present.

This is so simple, it's a one line trick:

    Public Function DKTxHE() As Boolean
        DKTxHE = RecentFiles.Count < 3
    End Function

> the typical lack of documents in a ... test environment make it easy ... for malware authors to fly under the radar

Dev environment is dissimilar to prod --> works in dev but not prod. Surprise, surprise.

Original blog: https://sentinelone.com/blogs/anti-vm-tricks/

View on HN

The funny thing about these is that the obfuscator leaves a billion clues that can tip you off that the macro is malicious, without even having to run it. Any human being can tell you that DKTxHE is a bogus name for a function, so the only trick is to implement that detection in code...

> Any human being can tell you that DKTxHE is a bogus name for a function, so the only trick is to implement that detection in code...

Don't people run code obfuscators on macros?

> the only trick is to implement that detection in code

String entropy scoring works surprisingly well for problems like this: build a corpus of function names (scrape it from github?), generate a markov model, see how probable the candidate function name is according to the markov model.

Then I'll just run a prettifyer with the same sample data and name functions in my malicious macros from that.

Like a lot of things, it's an arms race. For the most part people aren't doing that yet because it's easier, and almost as effective, to just generate them at random.

This is not novel, it's same general technique on a much more simplistic level as those that red pill uses.

edit: I don't really care about the downvote, but would have preferred a reply as to how it is that fundamentally different from silly stuff like checking device names, or even checking IDT location/ITLB contents/timing attacks This is clever-ish userspace stuff, but it's the same general idea and it's not new.

Reply on news.ycombinator.com