Loading story…
A technical walkthrough demonstrated how Windows executables can be modified to display convincing version information and familiar application icons without changing their trustworthiness or adding a valid publisher signature. Using a simple C program, a resource script, and the MinGW-w64 toolchain, the author showed how VERSIONINFO fields such as CompanyName, FileDescription, FileVersion, OriginalFilename, and ProductName, along with ICON resources, can be compiled into the .rsrc section of a PE file and linked into a final executable.
The examples included a benign message-box program first built without resources and then rebuilt with custom metadata and a browser-style icon to illustrate how attackers can impersonate legitimate software branding while remaining unsigned and untrusted. The reporting stressed that these fields are self-declared cosmetic indicators rather than proof of legitimacy, and that defenders should validate Windows binaries with stronger signals such as Authenticode status, file location, behavior, imports, and overall provenance instead of trusting icons or version strings alone.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The walkthrough presented a second executable, hack2.exe, built with a browser-style icon embedded through a separate resource script. The article said the sample was uploaded to ANY.RUN and received a verdict of "no threats detected."
A technical walkthrough showed how to compile a Windows C program, add VERSIONINFO and ICON resources via a .rc file and MinGW-w64, and link them into a new PE executable. It emphasized that fields such as CompanyName and ProductName, as well as icons, are self-declared cosmetic resources and not proof of legitimacy or publisher identity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecocomelonc.github.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Securelist reported that the little-known **Rich header** embedded in Windows Portable Executable files can reveal compiler, linker, and build-environment metadata that survives in many binaries and can help investigators profile malware authors. The research showed that this header, located between the DOS stub and PE header and XOR-obfuscated with a checksum-derived key, can expose toolchain fingerprints even when samples are packed or otherwise minimally modified. The report said analysts can use Rich header patterns to cluster related malware, distinguish shared development environments, and support attribution alongside other indicators rather than as a standalone proof point. Securelist also noted that the field is often overlooked by both attackers and defenders, making it a useful forensic artifact for reverse engineering and threat hunting when examining suspicious Windows executables.
Jul 12, 2026
A technical write-up introduced **PE-OopsSec**, a toolkit from Two Seven One Three designed to identify operational security mistakes and metadata artifacts in Windows Portable Executable (PE) files that can expose malware, payloads, or developer environments. The article details how defenders and analysts can use indicators such as subsystem settings, debug symbols, Rich Header data, `OriginalFilename` mismatches, timestamps, resource language IDs, import tables, RTTI, import hashes, fuzzy hashes, and entropy to cluster binaries, support attribution, and flag suspicious files in EDR platforms and sandboxes. The guidance frames PE metadata review as a pre-deployment checklist for red-team payloads and other Windows binaries, with mitigations including stripping debug information, using deterministic builds, disabling RTTI, dynamically resolving APIs, and reviewing hashes and entropy before release. A subsequent Reddit post amplified the article to the wider security community, positioning it as practical tradecraft for red teamers, malware reversers, and forensic practitioners rather than reporting a specific intrusion or malware campaign.
Jul 23, 2026
Threat actors are abusing **software-brand impersonation** to trick users into installing malware from fake distribution points, relying on social engineering rather than software exploits. Datadog reported an active campaign using **fake GitHub repositories** that impersonate established technology companies and leverage the **ClickFix** technique—prompting victims to copy/paste commands into *Terminal* (macOS) or *PowerShell/Run* (Windows)—to install infostealers. Datadog observed iterative updates to the *MacSync* lure and a new macOS infostealer variant self-branded as **“SHub Stealer v2.0”**, with expanded capabilities including **persistence** and **remote access**, alongside anti-analysis/evasion features intended to hinder detection and track infection outcomes; Datadog also assessed signs the actor is expanding toward **Windows infostealer** functionality. Separately, Malwarebytes documented a lookalike **7-Zip** download site (`7zip[.]com`, impersonating the legitimate `7-zip.org`) distributing a **trojanized installer** that installs a working 7-Zip File Manager while silently converting infected Windows systems into **residential proxy nodes**. The installer was **Authenticode-signed** with a certificate issued to **Jozeal Network Technology Co., Limited** (now revoked), and it dropped additional components—`Uphero.exe` (service manager/update loader), `hero.exe` (Go-compiled proxy payload), and `hero.dll`—under `C:\Windows\SysWOW64\hero\`; one reported case surfaced via Microsoft Defender detection `Trojan:Win32/Malgent!MSR` after the system had been exposed for an extended period. Together, the reporting highlights a sustained risk from **trusted-brand impersonation** and “looks legitimate” installers/repositories that deliver credential theft or monetize endpoints via proxyware.
Jul 2, 2026