Payload Storage

Storing Payload in PE file

Where i can store my Payload ?

in an EXE program we have sections and there is 3 sections that are good to store your payload inside them

• .text

• .data

• .rsrc

to store your payload inside .text section you need to put your payload into one of the functions in your code like main function for more info go here

to store your payload inside .data section you need to tell your compiler that your payload is read only data and the easiest way to do that is to create a global variable holding your payload for more info go here

to store your payload inside .rsrc section (.rsrc is a dedicated section for storing other files within a PE file like icons, images) we need to create a small file containing the payload and tell the compiler that this file should be part of the .rsrc section and then when the program runs your code has to use specific API Calls to reach out to .rsrc section and extract the payload from there for more info go here

Dropper

Droppers are malicious programs that are used to deliver your payload to the target machine and execute it