5

According to what I know ,Overlay is the part of PE file that is not covered by the PE header and therefore isn't part of the virtual image in the Loaded PE.

My question is if the overlay is not loaded along with all other code of the PE (sections) in the memory,How do overlay viruses execute?Do they read the file from the disk /

By overlay viruses I mean ,malware which run malicious code from its overlay?

rebel87
  • 205
  • 4
  • 11

1 Answers1

6

The overlay is just appended data to the end of the executable file. Detecting this can be tricky. But keep in mind that this portion is only ignored when loading an executable into memory. Opening the file for reading will allow access to the entire file including the Overlay portion.

The PE header will contain the size of the executable, and you can attempt to base the start of the overlay section on this. However, this size could be any size including zero or 0xffffffff.

Viruses most likely use the executable portion to gain a foothold into the system, and then load more more suspicious code into memory from the overlay once they have appropriate permissions. In this case the virus already knows where in the file to find its extra code.

The advantage here might be that the initial actions by the EXE will allow it past virus scanners to run, and the overlay portion isn't taken into account.

How to Append Data to an EXE is a nice little article that talks about how this can be done for legitimate means.

RoraΖ
  • 12,317
  • 4
  • 51
  • 83
  • Thanks a lot for the answer,so does this mean that the entry point cannot be in the overlay,but the exe can read its data (malicious code )in the overlay, using simple file pointers... – rebel87 Jan 05 '15 at 05:22
  • Yeah the binary can open itself, and read data in. For an entry point to be valid it would have to be marked as executable. That's an interesting question best suited for StackOverflow. I suppose you could engineer something like that, but then what's the point of appending data at all? Maybe obfuscation, but I think there are easier ways to obfuscate your code. – RoraΖ Jan 05 '15 at 12:53