[༄Anna༄]

What is the best way to avoid triggering google chrome detection when someone will download my file ?

I mean it's better to put everything in an RAR archive with a password or in a ZIP with a password ?

[DramaKing]

What is the best way to avoid triggering google chrome detection when someone will download my file ?

I mean it's better to put everything in an RAR archive with a password or in a ZIP with a password ?

This thread explains Google Safe Browsing: https://hackforums.net/showthread.php?tid=6244776.

[Tentco]

Google chrome Scanner is solely based on scantime, so you can do 2 things, either pump the file size to like 500mb around smh to exhaust the scanner, or obfuscate it properly/use a stager for your final payload.

[DramaKing]

Google chrome Scanner is solely based on scantime, so you can do 2 things, either pump the file size to like 500mb around smh to exhaust the scanner, or obfuscate it properly/use a stager for your final payload.

It's not just AMSI signature detection. Reputation plays a part, too. See the thread that I posted.

[Tentco]

It's not just AMSI signature detection. Reputation plays a part, too. See the thread that I posted.

Reputation has nothing to do with "This File is malicious warning.", the topic is about bypassing anti-virus not other warnings like- "This File is not Commonly Downloaded.", Good thread though.
Also the rep part is for red screen which can be easily bypassed, but im sure any one would have their own host to upload files and stuff.

[DramaKing]

Reputation has nothing to do with "This File is malicious warning.", the topic is about bypassing anti-virus not other warnings like- "This File is not Commonly Downloaded.", Good thread though.
Also the rep part is for red screen which can be easily bypassed, but im sure any one would have their own host to upload files and stuff.

I concede the point.

[༄Anna༄]

ty for this

???

[DramaKing]

???

What [mention=5543725] did is to post any random bit of text in any random thread in order to download an attachment.

[Brill]

Google chrome Scanner is solely based on scantime, so you can do 2 things, either pump the file size to like 500mb around smh to exhaust the scanner, or obfuscate it properly/use a stager for your final payload.

this pretty much sums up viable options. proper obfuscation and staged payloads are your best bet.

I suppose, in some unlikely situation, if you have control over the dns you can sinkhole the safe browsing domains, but you'll still get caught by defender without adequate obfuscation.
sb-ssl.google.com
safebrowsing.googleapis.com
safebrowsing-cache.google.com
safebrowsing.google.com