{"id":7267,"date":"2020-05-28T23:08:22","date_gmt":"2020-05-28T23:08:22","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=7267"},"modified":"2020-05-28T23:09:41","modified_gmt":"2020-05-28T23:09:41","slug":"genuine-anti-sandbox-trick","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2020\/05\/28\/genuine-anti-sandbox-trick\/","title":{"rendered":"Genuine Anti-sandbox trick"},"content":{"rendered":"\n<p>This a bit unusual trick, because it relies on a test if Windows version that sample is running on is&#8230; legitimate\/genuine.<\/p>\n\n\n\n<p>Yes.. we live in these times. Lots of pirated versions of Windows still floating around, but less than say 10 years ago.<\/p>\n\n\n\n<p>When I came up with the idea I googled around and discovered that to verify if Windows is genuine one has to run a single API: <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/api\/slpublic\/nf-slpublic-slisgenuinelocal\">SLIsGenuineLocal<\/a>.<\/p>\n\n\n\n<p>Encouraged, I crafted a small .exe that shows a message that takes a form of either &#8216;Genuine, continue&#8217; or &#8216;Pirated, exit&#8217;. Since sandbox engines are very unreliable I use 3 methods of message notification:<\/p>\n\n\n\n<ul><li>I print to STDOUT<\/li><li>I show a message box<\/li><li>I create a file with a name equal to the message chosen<\/li><\/ul>\n\n\n\n<p>To demonstrate the technique, I submitted a test file to VirusTotal hoping that its internal behavioral engine will pick it up. I was not disappointed and after a few tunings and tweaks VT JukeBox presented me with the <a href=\"https:\/\/www.virustotal.com\/gui\/file\/941825eb1c0e21e88e9e811bd761faf6d1a83b40953045233cbdd4f33413df2a\/behavior\/VirusTotal%20Jujubox\">result<\/a> as below:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/vt2-1.png\"><img decoding=\"async\" loading=\"lazy\" width=\"872\" height=\"799\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/vt2-1.png\" alt=\"\" class=\"wp-image-7269\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/vt2-1.png 872w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/vt2-1-300x275.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/vt2-1-768x704.png 768w\" sizes=\"(max-width: 872px) 100vw, 872px\" \/><\/a><\/figure>\n\n\n\n<p>Oh&#8230; can it be?<\/p>\n\n\n\n<p>Now, this may come as a surprise, but it is undeniable that many Jukebox sessions I have seen in the past present this bit to the sample submitter:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"184\" height=\"64\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/vt3.png\" alt=\"\" class=\"wp-image-7270\"\/><\/figure>\n\n\n\n<p>I am absolutely, positively, undeniably and equivocally certain that this is a genuine mistake and VirusTotal team will fix it soon.<\/p>\n\n\n\n<p>In the mean time, and to distract the audience, let&#8217;s remember that 5 engines detected my small .exe as malware:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"588\" height=\"218\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/vt4.png\" alt=\"\" class=\"wp-image-7271\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/vt4.png 588w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2020\/05\/vt4-300x111.png 300w\" sizes=\"(max-width: 588px) 100vw, 588px\" \/><\/figure>\n\n\n\n<p>The genius detectors are not surprising at all. As they say&#8230; garbage in, garbage out.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This a bit unusual trick, because it relies on a test if Windows version that sample is running on is&#8230; legitimate\/genuine. Yes.. we live in these times. Lots of pirated versions of Windows still floating around, but less than say &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2020\/05\/28\/genuine-anti-sandbox-trick\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[43],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7267"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=7267"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7267\/revisions"}],"predecessor-version":[{"id":7274,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/7267\/revisions\/7274"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=7267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=7267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=7267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}