1

How does malware usually embed into / infect exe files? (As in actually modifying the file on disk, not in memory). I've read it may look for gaps in the code section, insert its code, then redirect or change the entry point to that location. That makes sense, but what if there are no gaps large enough?

Specifically, would it be possible to insert bytes at the end of the code section, push everything else back, adjust the PE header/section sizes, then change the entry point to the new bytes? Or does something prevent this?

2
  • 1
    You've asked a question that is a little like "how long is a piece of string?" There are many techniques.
    – schroeder
    Mar 20, 2021 at 17:11
  • 1
    it loosk that you want to embed on the data segment code and of course that is possible, but as schroeder mention you should focus your question more.
    – camp0
    Mar 20, 2021 at 19:27

2 Answers 2

3

There are an enormous number of options. In no particular order:

  • You can enlarge the file, adding the malicious code and either making it the main entry point or adding a call to it from the existing entry point.
  • You can remove part of the file and replace it with your own code, if there's something you expect isn't needed (this is easier if you know the file in question).
  • You can replace a random chunk of the file that probably isn't needed for the program to launch and hope nobody notices in time.
  • You can scan all the libraries loaded by programs for insertion points for any of these techniques (including your original gaps) and infect those (hits lots of programs at once if you can do it to a shared library).
  • You can replace the file wholesale with one that has the same name and icon and is padded out to the same length but doesn't "work" at all.
  • You can replace the file but move the replaced code into its own boring-looking file that you execute in the foreground as soon as the replaced program starts, hiding the behavior.
  • You can edit the imports for the file to load a planted library that contains the malicious code (and optionally also calls the real library to do the expected thing).

...

Hopefully you get the idea. The difficulty is not in modifying the file, or even in hiding that you did so from casual observation. The difficulty is first getting code execution / file writing with sufficient privileges to modify executables at all, and second in preventing trivial detection and removal by AV software. That's a lot of why modern malware rarely does the classic "virus" thing you're talking about: it's too easy to write a signature for it, and remove it, once somebody knows to look. It doesn't have to be trivial, of course, and the better ones aren't, but it's usually not worth the effort.

1

Specifically, would it be possible to insert bytes at the end of the code section, push everything else back, adjust the PE header/section sizes, then change the entry point to the new bytes? Or does something prevent this?

Code signing can prevent this.

For example, on my Microsoft Windows 10 system, the "notepad.exe" program file is signed by Microsoft. If I modify a byte in "notepad.exe" the updated program file fails the signature check. The modified program file is considered "Unsigned."

Therefore, if running "Unsigned" code is prohibited these types of program file modifications can be avoided.

In practice, you might use AppLocker on Windows to enforce rules related to code signing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .