Search code examples
windowsportable-executablemalware

How can an executable be this small in file size?

I've been generating payloads on Metasploit and I've been experimenting with the different templates and one of the templates you can have your payload as is exe-small. The type of payload I've been generating is a windows/meterpreter/reverse_tcp and just using the normal exe template it has a file size around 72 KB however exe-small outputs a payload the size of 2.4kb. Why is this? And how could I apply this to my programming?

Solution

  • The smallest possible PE file is just 97 bytes - and it does nothing (just return).

    The smallest runnable executable today is 133 bytes, because Windows requires kernel32 being loaded. Executing a PE file with no imports is not possible.

    At that size it can already download payload from the Internet by specifying an UNC path in the import table.

    To achieve such a small executable, you have to

    • implement in assembler, mainly to get rid of the C runtime
    • decrease the file alignment which is 1024 by default
    • remove the DOS stub that prints the message "This program cannot be run in DOS mode"
    • Merge some of the PE parts into the MZ header
    • Remove the data directory

    The full description is available in a larger research blog post called TinyPE.