I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the decryption routine.

My first attempt was identifying uses and locations in the x86 for VirtualAlloc as I know memory will need to be allocated to perform the decryption. Is there anything else I should look for at the x86 level for code that will attempt to access this PE overlay?

1 Answer 1


I'd look for crypto code or API calls like GetModuleFileName and CreateFile(GENERIC_READ,....) because overlays aren't mapped into memory if I remember correctly. Therefore the malware has to open its own file on disk.

It then would need to parse the PE structure to find the end-of-image, unless the overlay has some kind of start/end marker, so looking for the constant 0x3C (e_lfanew in DOS header) or 'EP' or 'ZM' (reversed MZ and PE due to endianness) might locate such code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.