Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the decryption routine.
My first attempt was identifying uses and locations in the x86 for VirtualAlloc as I know memory will need to be allocated to perform the decryption. Is there anything else I should look for at the x86 level for code that will attempt to access this PE overlay?
I'd look for crypto code or API calls like GetModuleFileName and CreateFile(GENERIC_READ,....) because overlays aren't mapped into memory if I remember correctly. Therefore the malware has to open its own file on disk.
It then would need to parse the PE structure to find the end-of-image, unless the overlay has some kind of start/end marker, so looking for the constant 0x3C (e_lfanew in DOS header) or 'EP' or 'ZM' (reversed MZ and PE due to endianness) might locate such code.
