![Unpacking Malware, Trojans and Worms PE Packers Used in Malicious Software ,[object Object],[object Object]](https://image.slidesharecdn.com/pe-packers-used-in-malicious-software-part-1-3222/85/PE-Packers-Used-in-Malicious-Software-Part-1-1-320.jpg)
![[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Overview](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
En vedette
En vedette (12)
Similaire à PE Packers Used in Malicious Software - Part 1
Similaire à PE Packers Used in Malicious Software - Part 1 (20)
Plus de amiable_indian
Plus de amiable_indian (20)
Dernier
Dernier (20)
PE Packers Used in Malicious Software - Part 1
- 3. Refresher #1 - PE-COFF: The Windows Executable Format. Section-By-Section
- 8. Refresher #2 - The Who, How, What, Why of Windows Import Address Tables
- 17. DOS – MZ header
- 18. PE header
- 19. Windows reads section table
- 20. Memory allocated for executable
- 21. Disk image copied to memory
- 22. Windows populates IAT of PE packer
- 23. .UNPACKER section starts executing
- 24. .UNPACKER unpacks .PACKED-DATA into memory
- 25. Unpacked, it is now larger in memory
- 26. PE Packer populates Import Table
- 28. Jump to Original Entry Point (OEP)
- 29. And it runs!