hub / github.com/Maldev-Academy/ExecutePeFromPngViaLNK
github.com/Maldev-Academy/ExecutePeFromPngViaLNK @main
Chat with this repo
20 symbols
56 edges
3 files
0 documented · 0%
● updated 20mo ago★ 4791 open issues
What it actually does AI analysis from the code graph — generated when you open this
loading…
README
ExecutePeFromPngViaLNK
Extract and execute a PE embedded within a PNG file using an LNK file. The PE file is encrypted using a single-key XOR algorithm and then injected as an IDAT section to the end of a specified PNG file.
Quick Links
Usage
- Use
InsertPeIntoPng.pyto create the embedded PNG file and generate the extraction LNK file:
The generated LNK file will have the icon of a PDF file by default, and it will expect the embedded PNG file to be in the same directory when executed. PE files will be stored under the %TEMP% directory for execution.
Demo - Executing Dll
https://github.com/user-attachments/assets/adccab21-a05e-4f79-9590-b2ea4160ec4b
Demo - Executing Exe
https://github.com/user-attachments/assets/d47a0f3d-1689-4c57-bb1f-7559ad23ce04
Core symbols most depended-on inside this repo
print_redcalled by 6
InsertPeIntoPng.py
install
called by 3
InsertPeIntoPng.py
is_pe
called by 2
InsertPeIntoPng.py
generate_random_string
called by 1
InsertPeIntoPng.py
calculate_chunk_crc
called by 1
InsertPeIntoPng.py
xor_input_data
called by 1
InsertPeIntoPng.py
create_idat_section
called by 1
InsertPeIntoPng.py
remove_bytes_from_end
called by 1
InsertPeIntoPng.py
Shape
Languages
Python85%
C15%
Modules by API surface
InsertPeIntoPng.py17 symbols
Test/HelloWorldDll/HelloWorldDll/DllMain.c2 symbols
Test/HelloWorld/HelloWorld/Main.c1 symbols
For agents
$ claude mcp add ExecutePeFromPngViaLNK \
-- python -m otcore.mcp_server <graph>