Lab 9 · detection engineering

Reading the file for the lie.

Lab 6 read a process in memory. This is the static complement: the file on disk, before it runs. A Portable Executable is a rigid, well-documented format — which is exactly why abuse leaves marks in it. Binders staple a second program on; weaponized documents carry a launcher; fileless loaders avoid the disk entirely; worms copy themselves with a tell. Each one shows up as a structural anomaly. Learn the anatomy, and the triage falls out of it.

01 — the anatomy

How a PE is built

A PE is a stack of headers that tell the loader how to map the file into memory and where to start. Tap each region — it's where it sits, what it does, and the abuse surface a defender watches.

Tap a region to inspect it.

Mach-O, the macOS parallel

Same idea, different shape. A Mach-O opens with a magic number (often a fat/universal wrapper carrying arm64 + x86_64 slices), then load commands instead of a section table — LC_SEGMENT_64 (__TEXT r-x, __DATA rw-), LC_MAIN (entry), LC_LOAD_DYLIB (imports), and LC_CODE_SIGNATURE. The abuse surface rhymes: an unsigned or ad-hoc-signed binary, a suspicious extra dylib load, or DYLD_INSERT_LIBRARIES injection are the Mach-O equivalents of the anomalies below.

03 — the abuse surface, read defensively

What each technique leaves behind

binders / joinersStaple a payload onto a carrier file. Tells: data past the last section's raw end (the overlay) that is large and high-entropy; a second MZ/PE embedded inside; a dropper that writes a child to %TEMP% and runs it; icon + double-extension spoof (invoice.pdf.exe). Overlays are also normal in installers — so you corroborate with signing and behavior, never convict on overlay alone.

PDF embeddingA document that carries and launches code. You never execute it to check — you read the object tags. A tiny PDF with /OpenAction + /JavaScript + /Launch + /EmbeddedFile is a launcher wearing a document's clothes.

zero-transit / filelessNothing crosses the disk to scan. The code is staged in memory — a script host reflectively loads a PE it downloaded or decoded in RAM. There's no file to triage, so the signal moves to the process and memory layers (Labs 4B & 6): a private, unbacked executable region with no file ever written.

wormsSelf-propagation. Not a file shape but a fan-out: the same hash appearing on many hosts in minutes, bursts to SMB/RPC (445/135), copies written to shares and autostart. Lab 5's Blaster was a worm — this is that story at fleet scale, caught by rate and spread, not by one binary.

The tools that read these without running anything:

# PE: overlay, sections, entropy, signature, imports — no execution
pefile / PE-bear / CFF Explorer   # structure & overlay size
sigcheck                         # Authenticode: signed? valid? who?
capa / DIE                         # capabilities & packer ID from structure

# PDF: count the dangerous tags without opening it
pdfid statement.pdf
   /JavaScript 1   /OpenAction 1   /Launch 1   /EmbeddedFile 1   ← launcher shape

# macOS
codesign --verify --deep   ·   spctl --assess   ·   otool -l / -L

04 — the hard part

Structure lies both ways

Packing looks like malice — and isn't always. A high-entropy section and an entry point into the last segment scream “packed,” but commercial software packs too (licensing, anti-piracy). Packing is a question, answered by what unpacks (Lab 6) and by reputation.
Overlays are legitimate. Installers (NSIS, Inno), self-extracting archives, and signed updaters all append data. The binder tell isn't “has overlay” — it's overlay + unsigned + a second PE + dropper behavior, together.
Signatures get abused. Stolen code-signing certs and signed-but-vulnerable loaders (bring-your-own-binary) mean “signed” is necessary, not sufficient. You check who signed it and whether that publisher belongs here.
Fileless leaves nothing to triage. The whole point of zero-transit is to defeat this lab — which is why static triage is one layer, handing off to the memory and timeline labs when the disk comes up empty.

Static triage is fast, safe, and scalable — the right first filter. It narrows thousands of files to the few worth detonating in a sandbox or confirming in memory. It never convicts alone.

05 — provenance & citations

Where this comes from

tools & format Microsoft PE/COFF specification — the format of record.
pefile (E. Carrera) · pdfid / pdf-parser (D. Stevens) · capa (Mandiant) · Detect-It-Easy.
Apple Mach-O format & codesign/spctl.
this lab: github.com/Mik3XC/BlueTeamLab

mapping MITRE ATT&CK — Masquerading T1036, Embedded Payloads / binders, User Execution T1204, Reflective Loading T1620, Replication / worms.
the thread The weaponized PDF that drops the sled (Lab 8), that lands in RAM (Lab 6), beacons (Lab 4) and becomes the case (Lab 7). Lab 5's Blaster was the worm.