WrappEm: Uma Ferramenta para Injeção de Cargas Auxiliares por Manipulação em Nível de Byte no Windows

• Augusto Goulart IFFar
• Edson Fumagalli IFFar

DOI: https://doi.org/10.5753/errc.2026.35528

Resumo

Este trabalho explora métodos congêneres de subversão do Image Loader do Windows para a execução de cargas adversariais. Tais métodos utilizam técnicas de manipulação em nível de byte para modificar o Import Directory e, quando necessário, a Import Section de um arquivo executável. Isso força o Windows a carregar uma biblioteca adicional no espaço de endereçamento virtual do processo hospedeiro. Os artefatos resultantes desses métodos – implementados através de uma ferramenta de terminal (WrappEm) – demonstra que eles podem servir como alternativas às técnicas tradicionais de encaminhamento de exportação, as quais dependem de bibliotecas estruturalmente vazias e passíveis de detecção.

Referências

Aryal, K., Gupta, M., Abdelsalam, M., and Saleh, M. (2024). Intra-section code cave injection for adversarial evasion attacks on windows pe malware file.

Cheng, B., Ming, J., Leal, E. A., Zhang, H., Fu, J., Peng, G., and Marion, J.-Y. (2021). Obfuscation-Resilient Executable Payload Extraction From Packed Malware. USENIX Association.

Demetrio, L., Coull, S. E., Biggio, B., Lagorio, G., Armando, A., and Roli, F. (2021). Adversarial exemples: A survey and experimental evaluation of practical attacks on machine learning for windows malware detection. ACM TOPS.

Fernández-Álvarez, P. and Rodríguez, R. J. (2023). Module extraction and dll hijacking detection via single or multiple memory dumps. Forensic Science International: Digital Investigation, 44.

Hauser, M. and Cheptsov, V. (2020). Securing the edk ii image loader. In Proceedings - 2020 Ivannikov Ispras Open Conference, ISPRAS 2020, pages 16–25. Institute of Electrical and Electronics Engineers Inc.

Lad, S. S. and Adamuthe, A. C. (2022). Improved deep learning model for static pe files malware detection and classification. International Journal of Computer Network and Information Security, 14:14–26.

Ling, X., Wu, L., Zhang, J., Qu, Z., Deng, W., Chen, X., Qian, Y., Wu, C., Ji, S., Luo, T., Wu, J., and Wu, Y. (2023). Adversarial attacks against windows pe malware detection: A survey of the state-of-the-art. Computers and Security, 128.

Microsoft (2010). Microsoft portable executable and common object file format specification. Technical report, Microsoft Corporation.

Nataraj, L., Karthikeyan, S., Jacob, G., and Manjunath, B. S. (2011). Malware images: Visualization and automatic classification. Proceedings of the 8th International Symposium on Visualization for Cyber Security, pages 1–7.

Nguyen, M. T., Nguyen, V. H., and Shone, N. (2024). Using deep graph learning to improve dynamic analysis-based malware detection in pe files. Journal of Computer Virology and Hacking Techniques, 20:153–172.

Nisi, D., Graziano, M., Fratantonio, Y., and Balzarotti, D. (2021). Lost in the loader: The many faces of the windows pe file format. In ACM International Conference Proceeding Series, pages 177–192. Association for Computing Machinery.

Rizvi, S. K. J., Aslam, W., Shahzad, M., Saleem, S., and Fraz, M. M. (2022). Proud-mal: static analysis-based progressive framework for deep unsupervised malware classification of windows portable executable. Complex and Intelligent Systems, 8:673–685.

Yosifovich, P., Russinovich, M. E., Solomon, D. A., and Ionescu, A. (2017). Windows internals. Part 1: System architecture, processes, threads, memory management, and more. Microsoft Press.

Yousuf, M. I., Anwer, I., Riasat, A., Zia, K. T., and Kim, S. (2023). Windows malware detection based on static analysis with multiple features. PeerJ Computer Science, 9.

Zhang, Y., Chang, X., Lin, Y., Misic, J., and Misic, V. B. (2020). Exploring function call graph vectorization and file statistical features in malicious pe file classification. IEEE Access, 8:44652–44660.