1

I'm looking for a way to recognize an executable file as a NullSoft installer. I´m trying to prove that a malicious software is capable of changing the PE signature so we can not trust in some tool tell us a PE is a NullSoft Installer only because it have found the NullSoft signature.

Any help will be appreciated, recommended tools, etc ...

EDIT

After reading the Stolas's answer I decided to edit the question and add more info.

I already tried with to use an hex editor on an original NullSoft installer and I searched for the string NullSoft this yielded the following result:

Result for searching the string "Nullsoft" with UltrEedit.

The string was found in a XML:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
    <assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/>
    <description>
        Nullsoft Install System v2.46
    </description>
    <dependency>
        <dependentAssembly>
            <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*" />
        </dependentAssembly>
    </dependency>
    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
        <security>
            <requestedPrivileges>
                <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
            </requestedPrivileges>
        </security>
    </trustInfo>
    <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
        <application>
            <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
            <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
        </application>
    </compatibility>
</assembly>

These seems to be what I want to insert in my "malicious" app. So, how can I add that into my app?

My app it's just a "Hello world" written in Visual C++.

I'm aware that I have to write this at the same offset that in the original, but I just don't know how.

Improve this question
4
  • Could you clarify how this relates to FLIRT? You want to prove that IDA is vulnerable or something? – 0xC0000022L♦ Jun 18 '14 at 16:07
  • @0xC0000022L: I removed his flirt-signatures tag since there is no NullSoft installer FLIRT signature. Seems like he applied the wrong tag to his question. – Jason Geffner Jun 18 '14 at 16:15
  • @JasonGeffner Yes the tag was wrong, I ment signature no flirt-signature. – Raydel Miranda Jun 18 '14 at 16:42
  • It is well known that the format can be faked, since just need the right data at the right location. Why not reverse the order instead - create a NSIS file and then insert your non-NSIS data in place of the compressed content? This has the equivalent effect. – peter ferrie Jun 20 '14 at 20:07
4

For this you'd first need to realize how programs are recognized to be specific types of software.

This can be specific imports, strings or binary strings within the code. When you realize how tools make these signatures try to be cunning and put the signature in your 'malicious' application. Check it with your 'signature' tooling and tweak if required.

Improve this answer
1
  • nice answer, just to add, here is an idea to check: -- Add a new section ".ndata" to a target exe -- copy the appended data of a good nullsoft install package to a target exe. -- check against the software that recognizes sigs. Both can be done via a simple hex editor of your choice – Sigtran Jun 19 '14 at 8:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.