armijnhemel / binaryanalysis-ng

Binary Analysis Next Generation (BANG)
GNU Affero General Public License v3.0
461 stars 66 forks source link

Section "strings" are missed in metadata (7-zip.dll, 7-zip32.dll, 7z/***.exe) #374

Open chimelab opened 1 month ago

chimelab commented 1 month ago

The issue was found in scanning "7z2201-x64.exe". "strings" are missed in metadata, for any .dll or .exe in the 7z package. Below is an example of 7z/Uninstall.exe.

Output of command "strings":

.......................
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
<assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="7-Zip.7-Zip.Uninstall" type="win32"/>
<description>7-Zip Uninstaller</description>
.........................

Output of bang.cli: edab904fe77d4a18a45fdd1a9f537650/rel/Uninstall.exe

{   'labels': ['pe', 'executable'],
    'metadata': {   'hashes': {   'md5': '0c77e99dd91d1cd536b6db9d1c70ea2a',
                                  'sha1': '6d0a5e02841ed84a33518fdbb6bdc397d8a2f450',
                                  'sha256': '266bf84cc110ed4b34aedf904b36b60e29de0901978b0aa10c7e58cc072c2444',
                                  'tlsh': 'T1E662F843CBA444F1FBBB063079FE29575AB6BD2048949F1A43B07BDD0C38690EA66357'},
                    'imphash': '8658e3927099de6e638b64426fa1b2db',
                    'symbols': {   'exported': [],
                                   'imported': {   'ADVAPI32.dll': [   'RegQueryValueExW',
                                                                       'RegDeleteValueW',
                                                                       'RegOpenKeyExW',
                                                                       'RegCloseKey',
                                                                       'RegDeleteKeyW'],
                                                   ............................................
                                                   'ole32.dll': [   'CoCreateInstance',
                                                                    'CoInitialize']}}},
    'size': 14848,
    'unpack_parser': 'exe'}