Malware development trick 64: PE file bloating and overlay data. Simple C example
Brief
﷽
Hello, cybersecurity enthusiasts and white hackers!
In this post I want to look at another simple PE trick: file bloating , also known as binary padding. The idea is to make an executable much larger without changing its main behavior. This technique is mapped to MITRE ATT&CK T1027. 001 - Binary Padding .
Historically, attackers used oversized files to waste analyst time or to exceed file-size limits in scanners, sandboxes, mail gateways, and upload services. Modern security products should not trust size as a safety signal, and many of them can inspect large objects or apply partial scanning. Therefore, bloating is not a reliable bypass by itself.
For this laboratory experiment our program is harmless as usual: it only displays a Meow-meow! message box.