1

I'm looking for a way to recognize an executable file as a NullSoft installer. I´m trying to prove that a malicious software is capable of changing the PE signature so we can not trust in some tool tell us a PE is a NullSoft Installer only because it have found the NullSoft signature.

Any help will be appreciated, recommended tools, etc ...

EDIT

After reading the Stolas's answer I decided to edit the question and add more info.

I already tried with to use an hex editor on an original NullSoft installer and I searched for the string NullSoft this yielded the following result:

Result for searching the string "Nullsoft" with UltrEedit.

The string was found in a XML:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
    <assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/>
    <description>
        Nullsoft Install System v2.46
    </description>
    <dependency>
        <dependentAssembly>
            <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" />
        </dependentAssembly>
    </dependency>
    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
        <security>
            <requestedPrivileges>
                <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
            </requestedPrivileges>
        </security>
    </trustInfo>
    <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
        <application>
            <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
            <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
        </application>
    </compatibility>
</assembly>

These seems to be what I want to insert in my "malicious" app. So, how can I add that into my app?

My app it's just a "Hello world" written in Visual C++.

I'm aware that I have to write this at the same offset that in the original, but I just don't know how.

4
  • Could you clarify how this relates to FLIRT? You want to prove that IDA is vulnerable or something?
    – 0xC0000022L
    Jun 18, 2014 at 16:07
  • @0xC0000022L: I removed his flirt-signatures tag since there is no NullSoft installer FLIRT signature. Seems like he applied the wrong tag to his question. Jun 18, 2014 at 16:15
  • @JasonGeffner Yes the tag was wrong, I ment signature no flirt-signature. Jun 18, 2014 at 16:42
  • It is well known that the format can be faked, since just need the right data at the right location. Why not reverse the order instead - create a NSIS file and then insert your non-NSIS data in place of the compressed content? This has the equivalent effect. Jun 20, 2014 at 20:07

1 Answer 1

4

For this you'd first need to realize how programs are recognized to be specific types of software.

This can be specific imports, strings or binary strings within the code. When you realize how tools make these signatures try to be cunning and put the signature in your 'malicious' application. Check it with your 'signature' tooling and tweak if required.

1
  • nice answer, just to add, here is an idea to check: -- Add a new section ".ndata" to a target exe -- copy the appended data of a good nullsoft install package to a target exe. -- check against the software that recognizes sigs. Both can be done via a simple hex editor of your choice
    – Sigtran
    Jun 19, 2014 at 8:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.