---
id: 6075
title: "Malware development part 8 - COFF injection and in-memory execution"
source_domain: 0xpat.github.io
source_url: "https://0xpat.github.io/Malware_development_part_8/"
published_at: "2021-03-16T00:00:00Z"
tags: ["red-team", "code-injection", "cobalt-strike", "malware-development", "coff", "in-memory-execution"]
phying_url: "https://phying.com/item/6075"
lang: en
---

# Malware development part 8 - COFF injection and in-memory execution

## Summary

Part 8 of the malware dev series: a COFF object-file loader à la Cobalt Strike's BOFs—compiling C to .obj, parsing headers, sections and relocations, then executing the machine code from memory.

## Intelligence Metadata

- **Sources:** 0xpat.github.io
- **Published:** 2021-03-16T00:00:00Z
- **Original:** https://0xpat.github.io/Malware_development_part_8/
- **Phying News:** https://phying.com/item/6075