Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 881922" data-attributes="member: 32260">How SmartScreen can be bypassed by DLL hijacking? You can download a ZIP archive and unpack it by Windows built-in unpacker. The MOTW will be transferred to the EXE file. So it will be checked by SmartScreen on execution. But what if the EXE file is totally innocent and only loads and executes the DLL which was also unpacked together with EXE? SmartScreen does not check the DLLs loaded by EXEs, so the 0-day DLL will be executed.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" />Edit.Of course, the EXE has to be signed with a stolen certificate with a good reputation, and normally (with real-time AV protection) it would be simpler to use the malicious EXE (no DLL aside).&nbsp; This method could be useful only if someone wanted to hide the source of the infection (it is harder to find out it for malicious DLL). Such attacks may happen in businesses, and are not so dangerous for home users.The DLL hijacking can be also successful when one uses the security which does not check DLLs, but nowadays such attacks are very rare. For example, it can bypass Avast Hardened mode (Aggressive) and CyberCapture.</blockquote>

[QUOTE="Andy Ful, post: 881922, member: 32260"] How SmartScreen can be bypassed by DLL hijacking? You can download a ZIP archive and unpack it by Windows built-in unpacker. The MOTW will be transferred to the EXE file. So it will be checked by SmartScreen on execution. But what if the EXE file is totally innocent and only loads and executes the DLL which was also unpacked together with EXE? SmartScreen does not check the DLLs loaded by EXEs, so the 0-day DLL will be executed.:( Edit. Of course, the EXE has to be signed with a stolen certificate with a good reputation, and normally (with real-time AV protection) it would be simpler to use the malicious EXE (no DLL aside). This method could be useful only if someone wanted to hide the source of the infection (it is harder to find out it for malicious DLL). Such attacks may happen in businesses, and are not so dangerous for home users. The DLL hijacking can be also successful when one uses the security which does not check DLLs, but nowadays such attacks are very rare. For example, it can bypass Avast Hardened mode (Aggressive) and CyberCapture. [/QUOTE]

Verification