hasherezade / pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
https://hshrzd.wordpress.com/pe-sieve/
BSD 2-Clause "Simplified" License
3.01k stars 421 forks source link

Invalid resolving of recursively mapped paths #14

Closed hasherezade closed 6 years ago

hasherezade commented 6 years ago

Fragment of the invalid report:

{
"mapping_scan" : {
"module" : "400000",
"status" : 1,
"mapped_file" : "E:\\vboxsrv\\vm_shared\\KeygenMe V7.exe",
"module_file" : "E:\\KeygenMe V7.exe"
}
},