0

I'm doing in static analysis of PE file.

Can PE file have two or more executable sections?

How can we detect whether it is injected or not?

5

Can PE file have two or more executable sections?

Yes, it can, but it is atypical. Normally the compiler will make a section named ".text" with the correct permissions for executable code. But PE files in general can have multiple executable code section. A tool like PE Bear can tell you about the sections and their characteristics.

How can we detect whether it is inject or not?

It's not clear to me what you mean by "it is inject." Do you mean that the PE tries to inject code into another process? If this is what you mean, then this could only be determined by reverse engineering and understanding the functionality of the PE. You could start by looking at imports. For example, if it is going to try and inject into another process it might import WriteProcessMemory, VirtualAllocEx, and other API functions related to memory reading and writing across process boundaries. Of course, these might be obfuscated in general so the imports might not be obvious.

3
  • I mean meta-exploit framework can inject suspicious sections to executable. How can we detect it? – EsH Harshana May 11 '20 at 0:25
  • What do you mean by "suspicious sections"? Executable sections other than the ".text" section? – hft May 11 '20 at 7:39
  • Any section added after compilation.I want to build a tool for detect injected section (eg sections added by meta-exploit framework) – EsH Harshana May 11 '20 at 10:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.