hasherezade / pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
https://hshrzd.wordpress.com/pe-sieve/
BSD 2-Clause "Simplified" License
3.01k stars 421 forks source link

Crash during scan (Qakbot) #29

Closed hasherezade closed 5 years ago

hasherezade commented 5 years ago

Test case

eed6d6301fe7ee79ce88ac7a65f42532fc7caa24e59333e3e662b804da5f322f - Qakbot

Problem

PE-sieve crashes at the phase of saving the payloads (example from 1.6.1) crash_32 Scan status before the crash suggests that it happened during payload reconstruction: crash_moment