Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As you know files with PNF extension are associated with bitmap file type, from technically point of view how did authors of duqu implement this? as I concluded it is possible to make dlls in any file format, am I right?

share|improve this question
6  
I guess I don't understand the question, but you can load a DLL with any extension so long as the internal structure is in the PE format. –  SteveS Nov 20 '12 at 0:33
add comment

1 Answer

As SteveS said in the comments, Windows doesn't care what file name you use - it's just a label. The "file extension" is only used as an indicator for how a user can interact with the file. Many applications also use it as a way to indicate that the file is of a particular type, but ultimately it's nothing more than a naming convention and shouldn't be relied on.

As long as the file is a PE format module, it can be loaded into a process as a module, e.g. via kernel32.dll!LoadLibrary. In fact, Windows relies on this behaviour in many cases, since .exe, .dll, .cpl, .ocx, .sys, .scr and .drv files are all PE files.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.