AES-Managed Overlay Decryption

Description

A payload-staging pattern in which a .NET binary carries its encrypted payload not in a manifest resource, but as a raw file overlay appended after the last PE section. The outer binary opens its own file path, seeks past the PE headers and sections, and decrypts the overlay using System.Security.Cryptography.AesManaged (or Aes in newer .NET versions). The decrypted bytes are then loaded reflectively via Assembly.Load or bridged into native code.

Contrast with Manifest-Resource Staging

Overlay staging is harder to spot with standard PE resource tools because the payload is not indexed in the .rsrc directory. It requires file-carving or entropy analysis of the post-section gap.

Notable Examples

• 931242f8... (P.O_.exe) — 2.38 MB AES-managed overlay, decrypted with AesManaged + CryptoStream + MemoryStream. No GZip or Base64 layer observed. Overlay begins with repeating magic UKWES2V322hIwBbJ1183SGJ. ^[/intel/analyses/931242f8aab64f678147e83833b39bb35111e4359824f7ab694a74d5a80b8f8f.html]
• bc38233e... (PO1.exe) — 2.5 MB AES-CBC raw overlay with hardcoded 16-byte key LsFnDsm0WGBtR7C. ^[/intel/analyses/bc38233e18628256407420a857d1a1999974331cac7c5beb4368550d1d15f91d.html]

Detection

• File-size anomaly: PE with tiny .text / .rsrc but total size > 1 MB
• Entropy spike in the post-section region
• Strings referencing FileStream, ReadAllBytesFromFile, AesManaged, CryptoStreamMode alongside Assembly.Load

Related

• unclassified-dotnet-crypter-loader
• dotnet-manifest-resource-decryption