ExecutePeFromPngViaLNK: Extract and execute a PE embedded within a PNG file using an LNK file

ExecutePeFromPngViaLNK

Extract and execute a PE embedded within a PNG file using an LNK file. The PE file is encrypted using a single-key XOR algorithm and then injected as an IDAT section to the end of a specified PNG file.

Download

git clone https://github.com/Maldev-Academy/ExecutePeFromPngViaLNK.git

Use

1. Use InsertPeIntoPng.py to create the embedded PNG file and generate the extraction LNK file:

The generated LNK file will have the icon of a PDF file by default, and it will expect the embedded PNG file to be in the same directory when executed. PE files will be stored under the %TEMP% directory for execution.

Support Our Threat Intelligence

If you find our technology report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy