Reflective PE Loader

A position-independent shellcode routine that receives a raw PE file in memory and manually maps it, resolves imports, applies relocations, and transfers execution — all without calling LoadLibrary on the payload itself.

Pattern Definition

1. Parse headers: Walk DOS header → e_lfanew → COFF → Optional header → section table.
2. Allocate image buffer: VirtualAlloc with size OptionalHeader.SizeOfImage.
3. Map sections: Copy each section from file offset to its assigned RVA.
4. Resolve imports: Walk Import Directory, call LoadLibraryA/GetProcAddress for each DLL/function, patch IAT.
5. Apply relocations: If image base differs from OptionalHeader.ImageBase, adjust RVA-based fixups.
6. Execute: Call AddressOfEntryPoint (or CreateProcessW + thread hijack for external process).

Implementation (observed in 70848598 shellcode)

• fcn.000025b0 — Main PE loader. Opens n3d2ll.dll (filename built from stack), reads file to buffer, maps with VirtualAlloc(0, SizeOfImage, MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE), copies sections, resolves imports via PEB walking.
• fcn.00003520 — Export hash resolver: walks InLoadOrderModuleList, hashes each exported name with CRC32, compares against a target hash.
• fcn.000034c0 — PEB walker: fs:[0x30] → PEB.Ldr → InLoadOrderModuleList.

The loader is fully self-contained — no imports table for the shellcode itself. ^[shellcode_disasm.txt]

Detection / Fingerprint

• Memory regions with PAGE_EXECUTE_READWRITE that contain a mapped PE (MZ at RVA 0, PE signature at e_lfanew).
• LoadLibraryA calls for system DLLs from a memory region outside any module.
• Import resolution loops: repeated GetProcAddress calls with names like VirtualAlloc, CreateProcessW, NtQueueApcThread.

Defensive Countermeasures

• Memory scanning: hunt for PE headers in RWX regions.
• API hooking: flag VirtualAlloc + PAGE_EXECUTE_READWRITE in non-standard processes.
• ETW: monitor for ImageLoad events where the loaded module does not correspond to a file on disk.

Pages Where Observed

• unattributed — 70848598 primary sample