Guess Who Am I? PE Or APK

 

 

 

Update: I happened to find this sample. However, it was corrupted.  So I made a demo file by myself. Notepad.exe was used as PE stub, and I embedded a MALICIOUS APK sample into it. So the magic number was also MZ. It ran better than the previous sample since it bypassed zipfile.py and you can see its internal apk information. 

If you need this sample, leave your email or drop me a line. You are welcomed to polish its PE structure to make it runnable. Don't forget to let me know if you make it. Good luck!
 
Does "zipfile.BadZipfile: Bad magic number for file header" sound familiar?

This error message is caused up by zipfile.py when a file fails in the ZipFile parsing.

Normally, the magic signature for a zip file is 1)"PK\003\004" , 2) "PK\005\006" (empty archive), or "PK\007\008" (spanned archieve).

 

Here is an android example which triggers the above message. Guess what is its magic number? - 4D 5A 90 90   Yes, you are right. It is "MZ", the PE magic number.

 

 

The author faked DOS header, PE header, section table, and even import table structure at the very beginning of this file so that quite a few AV engines and tools are bypassed.

 

 

 

 

 

 

 Here is the snapshot from VT:

 

 

 

7-zip unpacked partial contents including the classes.dex and Manifest files. The classes.dex is valid. There were some ADMOB SDK APIs called, and the android payload was hidden inside .text section.

This sample ran "su" command to get the root privilege. Afterwards, it visited the following websites:

 

mm.admob.com/static/android/i18n/20101109

/api.admob.com/v1/pubcode/android_sdk_emulator_notice

 ...

This is the only sample of trying to hide APK contents inside PE format I can find so far. I am expecting more in the near future.