Certificate Bypass: Hiding and Executing Malware from a Digitally Signed Executable
summary
Demonstrates a method to append a PE payload into the PE attribute certificate table (ACT) of a signed Microsoft Office binary, update the security-directory and checksum, and execute the embedded HydroCrypt ransomware from memory using a homegrown reflective loader. The public claim: modified signed binaries yield zero detection on tested AVs; tools shown are Certificate Bypass and a Reflective EXE Loader that maps, relocates and resolves imports in-host and successfully runs the ransomware; Deep Instinct’s agent blocks and detects the technique in the demo.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:16Announcements
- 2:46Can You Really Trust a Digitally Signed File
- 3:43The Image Optional Header
- 8:45Extract the Base Address
- 12:56Process the Import Address Table of Parrot Pe
- 17:56Change the Memory Permissions of Payload
- 18:29Calculate the Entry Point Address of Payload
- 20:56Enable the Security Solution
- 25:11Side Notes
related talks
51mSneaking Past Device Guard
29mRendering Ransomware Detection and EDR Products Blind
25mCommSec D1 - A Deep Dive Into Malicious Documents
37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed Vulnerability
48m"Sneaking Past Device Guard"
52mFlying Under the Radar - New Security Evasion Techniques
42mCracking the Perimeter with SharpShooter
43mMalicious Payloads vs Deep Visibility: A PowerShell Story