Malware Theory - PE Malformations and Anomalies

Explore how malformations in the Portable Executable format affect parsers and how malware authors exploit them.

We explore malformations and anomalies of the Portable Executable format. What kinds of malformations exist, why do they occur and how do they affect PE file parsers? Malware analysis courses: malwareanalysis-for-hedgehogs.learnworlds.com/courses Buy me a coffee: ko-fi.com/struppigel Follow me on Twitter: twitter.com/struppigel OALabs video with export malformation: youtube.com/watch?v=FNuFlhnfZQU Video on PE Structure: youtube.com/watch?v=l6GjU8fm8sM Video on PE Resources: youtube.com/watch?v=3PcgwKffytI PoC PE files with malformations (Corkami): github.com/indrora/corkami/tree/master/src/PE TinyPE: webserver2.tecgraf.puc-rio.br/~ismael/Cursos/YC++/apostilas/… Portable Executable Malware: github.com/katjahahn/PortEx/raw/master/masterthesis/masterth… PortExAnalyzer: github.com/struppigel/PortexAnalyzerGUI