As mentioned in the previous lesson there are hundreds of file types used for malware across different "stages" of the delivery chain before they land the true backdoor. However, most final backdoor payloads end up as executables designed for the common operating systems.



Learning about the different executable structures can help you understand how malware works and help you identify various features, attributes, toolmarks, or other characteristics that might be good for YARA rules.



If you have not dabbled in image formats before, and if you are not familiar with some of the underlying operating system functions, some of this material may seem overwhelming at first. But don't freak out just yet! Watch some of the videos below and come back to the references if you have questions about a particular component.



What is most important to learn is that all executables are just data structures, with many substructures and components designed to help the OS run a program. These structures expose clues that can help you detect malware, and over time, you will begin to notice what elements of the file structure are more informationally rich for detection purposes and what is normal and abnormal within these structures.



YARA makes life easy for you by parsing and exposing many important file format features through the modules, so be sure to explore those and figure out what they represent so you can understand why and how to use them for detection. 



Here are some resources and notes to get you started.



Windows Executables



Most analysts call these "PEs" even though we are referring to any MZ DOS executable that runs with a .exe or .dll extension.



There are three common PE formats that you should be familiar with:



PE EXEs and PE DLLs
EXEs and DLLs share the same PE format, with some nuanced differences. DLLs typically export functions to the operating system.
YARA's "pe" module is great at exposing the important PE features.
Videos
7 min - Understanding the PE Header (HackerSploit), this is a brief overview of typical PE structure and components
https://www.youtube.com/watch?v=vQPz3QFDR3c
30 min - Getting Started with the Portable Executable (PE) File Format (Josh Stroschein), first 30 minutes is a general walkthrough of the PE format with some context on the different substructures
https://www.youtube.com/watch?v=CM2Tfvxrs74&t=1s
Reading
https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
https://wiki.osdev.org/PE
https://yara.readthedocs.io/en/stable/modules/pe.html


.NET PE
.NET PEs (a/k/a "assemblies") are executable EXEs or DLLs built with a .NET programming language and the the Windows .NET framework or .NET core. Because these involve "managed code" they have a slightly different PE format and other features that make them unique. YARA's "dotnet" module exposes many of these features.
Videos
3 minutes - An Overview of .NET Assemblies (Gavin Lon)
https://www.youtube.com/watch?v=4nKkz-snwgM
Reading
https://learn.microsoft.com/en-us/dotnet/standard/assembly/file-format
https://yara.readthedocs.io/en/stable/modules/dotnet.html




Linux/Unix Executables



In the world of Linux/Unix systems, most malware comes as an ELF file. There are two main types of ELF formats, shared objects (ELF SO) and executable (ELF EXEC) and most malware lands as the latter.



ELF EXEC
Videos
20 minutes - ELF - The Extensible and Linkable Format (stacksmashing)
https://www.youtube.com/watch?v=nC1U1LJQL8o
Reading
https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/
https://wiki.osdev.org/ELF
https://www.cs.cmu.edu/afs/cs/academic/class/15213-f00/docs/elf.pdf
https://yara.readthedocs.io/en/stable/modules/elf.html
