{"id":13936382,"url":"https://github.com/hegusung/AVSignSeek","last_synced_at":"2025-07-19T21:32:33.045Z","repository":{"id":82958167,"uuid":"111597282","full_name":"hegusung/AVSignSeek","owner":"hegusung","description":"Tool written in python3 to determine where the AV signature is located in a binary/payload","archived":false,"fork":false,"pushed_at":"2018-03-24T13:06:54.000Z","size":16,"stargazers_count":312,"open_issues_count":1,"forks_count":53,"subscribers_count":23,"default_branch":"master","last_synced_at":"2024-11-27T04:30:58.085Z","etag":null,"topics":["antivirus-evasion","antivirus-testing","python3"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hegusung.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-11-21T20:22:21.000Z","updated_at":"2024-11-10T17:07:18.000Z","dependencies_parsed_at":null,"dependency_job_id":"4f5b4857-0089-4622-95fd-5e704d2b9f77","html_url":"https://github.com/hegusung/AVSignSeek","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/hegusung/AVSignSeek","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hegusung%2FAVSignSeek","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hegusung%2FAVSignSeek/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hegusung%2FAVSignSeek/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hegusung%2FAVSignSeek/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hegusung","download_url":"https://codeload.github.com/hegusung/AVSignSeek/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hegusung%2FAVSignSeek/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266019657,"owners_count":23864916,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["antivirus-evasion","antivirus-testing","python3"],"created_at":"2024-08-07T23:02:37.025Z","updated_at":"2025-07-19T21:32:28.035Z","avatar_url":"https://github.com/hegusung.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"# AVSignSeek\nTool written in python3 to determine where the AV signature is located in a binary/payload\n\n## Usage \n\nZip (with a password) your binary/payload caught by an AV so it won't be detected when placed in an environment protected by an AntiVirus.\nLaunch the tool and specify the zip password and filename in the zip with the -p and -f options (infected/infected.bin by default)\n\nThis tool won't work for complex signatures\n\n```\n./avsignseek.py zipfile.zip\n```\n\nThe tool will drop multiple files on the disk to determine on which pattern the signature is based on. It will obviously generate a lot of AV alerts, might be a good idea to run this on an host with no internet connection.\n\nOnce done, the result will be printed in stdout and a file (output.txt by default) containing the result will be generated.\n\nIf you know approximatly where your signature is located, you can specify one or more range in the payload to be analysed using the -r option. In the following example AVSignSeek will only try to find a signature in the following ranges:\n* 0-256\n* 336-416\n* 432-endofpayload\n\nSyntax:\n```\n./avsignseek.py zipfile.zip -r :0x100,0x150:0x1a0,0x1b0:\n```\n\n## Help\n\n```\nAutomatically detects AV Signatures\n\npositional arguments:\n  zip_file\n\noptional arguments:\n  -h, --help          show this help message and exit\n  -s SLEEP            waiting time between 2 tests (default: 20)\n  -p ZIP_PASSWORD     zip password (default: infected)\n  -f FILENAME         file name contained in the zip (default: infected.bin)\n  -l LIMIT_SIGN       signature limit (default: 64)\n  -d TEST_DIR         directory where testfiles will be placed (default: .)\n  --subdiv SUBDIV     subdiv per step (default: 4)\n  -o OUTPUT_FILE      output_file (default: output.txt)\n  -r RANGES_STR       range (default: \":\")\n  -b REPLACING_VALUE  character or byte used as a replacing value (default: \"0x00\")\n  --manual            wait for a manual input instead of a specific time (default: false)\n```\n\n## Output example\nReflective DLL caught by Kaspersky AV, the signature based on the exported dll function name \"ReflectiveLoader\"\n\n```\n=== AVSignSeek ===\n[+] Signature between bytes 88220 and 88284\n[+] Bytes:\n4d 61 6c 77 61 72 65 54 65 73 74 2e 64 6c 6c 00 \tMalwareTest.dll.\n52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 \tReflectiveLoader\n00 66 75 6e 63 5f 74 65 73 74 00 00 00 00 00 00 \t.func_test......\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 \t................\n[+] Strings:\n\u003e MalwareTest.dll\n\u003e ReflectiveLoader\n\u003e func_test\n```\n\n## Troubleshooting\n\n### False Positives due to binary header\n\nWhile trying to locate the AV signature, the AVSignSeek might break a header or another way used by the AV to determine the file type, and the AV won't detect the file as malicious anymore, resulting in a false positive.\nIt can be prevented by using the start byte and end byte option (-s and -e) to remove the \"header\" from the analysis\n\n### Unable to locate the signature\n\nIf there is multiple signature in a single payload, AVSignSeek won't be able to locate them\n\n## Future developments\n\n* Multiple signature detection\n* PE-specific signature detection (it will detect in which section/exported function/... the signature is located)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhegusung%2FAVSignSeek","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhegusung%2FAVSignSeek","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhegusung%2FAVSignSeek/lists"}