The Basics of Overlays in PE Files

Malware authors will often abuse the structure of the portable executable (PE) file format to avoid detection and hide additional resources. Overlays are one such example of a legitimate PE file feature that is often abused. In this video, I'll cover the basics of overlays in PE files. We'll look at a couple of sample binaries, use Detect-it-Easy and PEStudio to identy information about the overlays, as well as look at the structure of these PE files using a hex-editor. …

abuse authors basics detect detection file files hide information malware overlays portable portable executable resources video