Concerned about recent PAN-OS and other firewall/VPN CVEs? Take advantage of Zscaler’s special offer today

Zscaler Blog

Get the latest Zscaler blog updates in your inbox

Security Research

Guess Who Am I? PE Or APK

March 15, 2013 - 2 min read
Update: I happened to find this sample. However, it was corrupted.  So I made a demo file by myself. Notepad.exe was used as PE stub, and I embedded a MALICIOUS APK sample into it. So the magic number was also MZ. It ran better than the previous sample since it bypassed and you can see its internal apk information. 

If you need this sample, leave your email or drop me a line. You are welcomed to polish its PE structure to make it runnable. Don't forget to let me know if you make it. Good luck!
Does "zipfile.BadZipfile: Bad magic number for file header" sound familiar?
This error message is caused up by when a file fails in the ZipFile parsing.
Normally, the magic signature for a zip file is 1)"PK\003\004" , 2) "PK\005\006" (empty archive), or "PK\007\008" (spanned archieve).
Here is an android example which triggers the above message. Guess what is its magic number? - 4D 5A 90 90   Yes, you are right. It is "MZ", the PE magic number.
The author faked DOS header, PE header, section table, and even import table structure at the very beginning of this file so that quite a few AV engines and tools are bypassed.
Figure 1 
 Here is the snapshot from VT:
7-zip unpacked partial contents including the classes.dex and Manifest files. The classes.dex is valid. There were some ADMOB SDK APIs called, and the android payload was hidden inside .text section.
This sample ran "su" command to get the root privilege. Afterwards, it visited the following websites:

This is the only sample of trying to hide APK contents inside PE format I can find so far. I am expecting more in the near future.



form submtited
Thank you for reading

Was this post useful?

dots pattern

Get the latest Zscaler blog updates in your inbox

By submitting the form, you are agreeing to our privacy policy.