Memory loading method based on PE file transformation

Abstract

The invention discloses a memory loading method based on PE file transformation. The memory loading method comprises the steps: compressing a target PE file; developing a PE loader; splicing and encrypting the compressed target PE file and the PE loader, and encoding the encrypted data into a picture as a resource to be inserted into a host PE file; developing a code loader for extracting bitmap resources, decrypting and executing the PE loader, and inserting the PE loader into the code segment of the host PE file; and hijacking the control flow near the OEP of the host PE file to obtain an execution right, releasing the final host PE file and running the final host PE file. According to the method, the host PE file is transformed, the target PE file is compressed, spliced and encrypted with the PE loader and then encoded into picture resources to be inserted into the host PE file, then the resources are extracted, decrypted and executed by the code loader, and the capacity in bypassing a detection mechanism is improved through technologies such as entry point obscuring and anti-sandbox detection.

Description

technical field [0001] The invention relates to the technical field of network security, specifically, a memory loading method based on PE file modification. Background technique [0002] With the rapid development of computer and Internet technology, information has become an important resource in today's society. While even the most advanced systems can be compromised by malicious code, the longer the malware persists in the target system, the more information it collects and the more damage and damage it can cause to the target. Memory loading is one of the key techniques for malware to achieve concealment. Unlike traditional malware loading techniques, malware loaded using memory does not have to reside on the hard disk, but utilizes conditions or system components provided by some legitimate, trusted processes to run itself to evade detection. Their stealthy nature presents a great challenge to malicious code analysts. Due to the volatile nature of memory, the traces...

AI Technical Summary

Problems solved by technology

[0003] The purpose of this invention is to provide a memory loading method based on PE file transformation, which is used to alleviate the problem that the existing detection mechanism cannot deal with unknown memory loading methods, and to enhance Existing malicious code detection mechanism and machine learning model provide reference basis

Images