[EP_X0FF]

This document contains short overview of existing and exploited by WinNT malicious software (malware) methods (AntiVM) that help malware detect execution in the controlled environment such as virtual machine (VM) or/and sandbox. However, this is not complete R&D of each malware with AntiVM, we will focus only on most popular and often seen methods. Unlike other articles, we will show other methods that detect presence of the software VM. We assume readers are familiar with Windows NT based malware, Windows NT core components, x86 architecture and programming languages.

PDF in attach.

With best regards to my colleague rinn

[AaLl86]

Very nice paper. Just read about initial pages and I really appreciate it.
Thanks for sharing

Andrea

[forty-six]

So many downloads and such little gratitude shown.

Lately it seems like there is more VM detection in the samples I have analyzed. Not sure if this is perception or reality. Valuable document and good read. Thanks for sharing.

[myodyne]

Thank you very much..

Great information.

[DerW_234]

Thanks, this should be interesting!
I heard in a presentation a while ago, that malware uses less Anti-VM nowadays (because many servers run on virtual machines), but "consumer" malware will probably increase their VM evasion efforts nevertheless, so it's good to stay ahead or at least know what's possible :).

[EP_X0FF]

VMDE source adapted to 2015 and posted on github https://github.com/hfiref0x/VMDE. Do not consider it as fully functional vm detector, as it was a part of our with rinn work later used to develop VBox andtidetection patch.

[t4L]

Nice work EP_X0FF :)

Next thing we'll see is HF kids and such will copy-n-paste your code into their buggy mw. :lol:

[EP_X0FF]

Why not. At least finally some % of "their" code will be properly written. But as I said before vmde is just a side work of vbox anti-detection patch we planned from middle of 2013.

[Sargerras]

thanks for nice documentation.

[richarduu]

Thanks!
And also thank you so much for all the sharing including analysis result and samples!
I am new to malware research, and find this forum to be the haven of malware research because of people like you!
Thank you @EP_X0FF!