Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As you know files with PNF extension are associated with bitmap file type, from technically point of view how did authors of duqu implement this? as I concluded it is possible to make dlls in any file format, am I right?

share|improve this question
I guess I don't understand the question, but you can load a DLL with any extension so long as the internal structure is in the PE format. – Steve Nov 20 '12 at 0:33

As SteveS said in the comments, Windows doesn't care what file name you use - it's just a label. The "file extension" is only used as an indicator for how a user can interact with the file. Many applications also use it as a way to indicate that the file is of a particular type, but ultimately it's nothing more than a naming convention and shouldn't be relied on.

As long as the file is a PE format module, it can be loaded into a process as a module, e.g. via kernel32.dll!LoadLibrary. In fact, Windows relies on this behaviour in many cases, since .exe, .dll, .cpl, .ocx, .sys, .scr and .drv files are all PE files.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.