The relevant files for this question are here:
Contains a before and after DLL. This simple PHP script demonstrates the problem:
<?php $ts = microtime(true); file_put_contents("test.dll", file_get_contents("32_pe_msmpeng_before.dll")); echo "Time taken: " . sprintf("%.02f", microtime(true) - $ts) . " sec\n"; unlink("test.dll"); $ts = microtime(true); file_put_contents("test.dll", file_get_contents("32_pe_msmpeng_after.dll")); echo "Time taken: " . sprintf("%.02f", microtime(true) - $ts) . " sec\n"; unlink("test.dll"); ?>
The output looks like:
>php test.php Time taken: 0.00 sec Time taken: 4.14 sec
The only difference between the two DLLs is that the certificate table has been removed and the PE checksum has been updated in the "after" DLL. The 4 second delay is caused by MsMpEng.exe using 100% of one core of a CPU during that time. MsMpEng.exe is the main Windows Defender realtime scanning engine. The files are not flagged as malware but the behavior is bizarre in that simply removing the certificate table would trigger a deep scan.
The original file was modified using my Windows PE File Tools for PHP and these commands:
php pe_tools.php modify clear-certs 32_pe_msmpeng_before.dll 32_pe_msmpeng_after.dll php pe_tools.php modify apply-checksum 32_pe_msmpeng_after.dll 32_pe_msmpeng_after.dll
I've checked the "after" file in every conceivable way I can think of and it appears to be completely valid to all of the tools I've used. I've also modified plenty of other PE files without tripping up the realtime scanner. Just this file causes the time delay and spike in CPU usage and that only happens after the certificate table is removed. I can make all kinds of other crazy changes to the file that should immediately result in an invalid certificate table (e.g. adding a new PE section, embedding icons, etc) and it won't trip up the realtime scanner either. But remove the certificate table entirely and that 4 second delay + 100% CPU in MsMpEng.exe appears. This behavior seems to imply that just having a certificate table possibly bypasses portions or even, um, all of Windows Defender...
But that's not really the question. What I'd like to know is what exactly is in the "after" DLL that is causing MsMpEng.exe to conduct a deep scan that takes upwards of 4 seconds to complete?