I do not endorse malware in any way, shape or form and the following Information is for research purposes only. I think the whole idea of AV software is dumb and I like to help people realize that.

I could just change the form to dll

It’s still a PE file and AV will of course scan those (also scr, com and whatever)

and run it with rundll32

Thats pretty likely in every detection heuristic ever

I could use hta files

Thats also suspicious, but if you only use it for c&c logic and install stuff you might get away with it. You could be creative and use onboard or standard software to do the dirty work.

or macro

Seems to work shockingly well according to the steady stream of ransomware news… I got an emotet email some time ago. I analyzed it and they used macros to execute a powershell script which tried to download a PE loader from multiple sources.

Any ideas to share on this?

If your files are flagged before running they either share a signatur with some known malware or they just use suspicious windows api-calls or you used a packer. If the first is true, did you plagiarize parts of it? If yes then lol and you can play around with some compiler flags to maybe change the output enough. Also you could try changing parts of the executable (just replace bytes block by block) to identify what part of it is problematic. For the second possibility you can dynamically load and call the libs at runtime but this won’t help against runtime heuristics. Also you could add some dead code (make sure it doesn’t get optimized out) that uses other functions to enhance the suspicious/non-suspicious call ratio.

@TheOPtimal’s method won’t work because once you decoded the file to disk AV will flag it. You’d need to decode the file in memory and then execute it, which is what most malware did back when I still was interested in this topic. If you have a simple decrypter&loader you can easily modify it each time AV company adds a signature. For each intel instruction you can find (basically unlimited) sets of other instructions that do the same thing but have a different signature. But I’d guess most AV software will have heuristics for self-modifying code.

Is this form of post content allowed? I’d expect malware not to be endorsed here 👀

Encode the obfuscated exe in base64 multiple times and decode it in a batch file. Obfuscate the batch file aswell.