Malware development trick 63: modifying PE version metadata and icon. Simple C example
Brief
﷽
Hello, cybersecurity enthusiasts and white hackers!
In this post I want to look at a very simple PE build-time trick: adding version information and an application icon to a Windows executable. This time I will start the experiment as usual with a small “malware” C program and the MinGW-w64 toolchain on Linux.
Windows executables often contain descriptive fields such as CompanyName , FileDescription , FileVersion , OriginalFilename , and ProductName . File Explorer displays these values in the Details tab, and other tools can read them from the PE resources.
An executable without version metadata is not automatically malicious, and an executable with a polished icon is not automatically trustworthy. These values are cosmetic and self-declared. They can improve the appearance of legitimate internal utilities, but they can also be abused for masquerading.