Load Resources

What is a resource

Code and executables download: From GitHub

Often, malicious and non-malicious software use other embedded files for different reasons. For example, ransomware might use an embedded image (called “Resource” by Microsoft) as a desktop image to inform the victim that their client has been infected. The same concept can be applied to any file type: ransom notes as txt files, PowerShell scripts, other .exe or .dll files, and so on.

The reasons why a malware author might want to embed a resource in the executable can vary. For example, embedding a resource can avoid unnecessary web calls to download an image, or provide a secondary payload (.exe with a different hash from the primary payload). Consider an executable that is on a system. When the user executes it, the sample deletes itself. This might seem odd; however, the sample might have extracted a secondary payload and moved it somewhere else. Searching for the hash of the first payload will no longer report any findings on the infected machine, since the first payload has removed itself and the second payload might go unnoticed.