I am attempting to understand the PE File Format and I have come across an unexpected value in the IMAGE_THUNK_DATA Array.
Here are the file details:
File Name: ChromeSetup.exe Link: hxxps://www[.]google[.]com/chrome/thank-you.html?platform=win64&statcb=1&installdataindex=empty&defaultbrowser=0
(After some testing, I found out that the hash changes but the issue is the same.)
That first block i.e. (48fe 0100), resolves perfectly to "SHGetFolderPathW". But that second block (a8020080) is out of bounds - adjusting for endian format, we get 0x800002a8 - but the file itself is present up till 0x14DE2A (verified via 010 Editor and xxd). The third block signifies the end of the IMAGE_THUNK_DATA array so no issues there.
I've checked using 010 Editor and it shows "SHGetFolderPathW" as the only function imported from SHELL32.dll. I'd greatly appreciate some help understanding why that second block is present if no function name resolves to that address, which is out-of-bounds by itself?