Failed reconstructing the payload (Ursnif)

hasherezade / pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

https://hshrzd.wordpress.com/pe-sieve/

BSD 2-Clause "Simplified" License

3.01k stars 421 forks source link

Failed reconstructing the payload (Ursnif) #32

Closed hasherezade closed 5 years ago

hasherezade commented 5 years ago

Test case

633521d921ddad8671293319f0fd9daab9a0a606887ada3ab3709027cbb1e591

Problem

The payload has a partially corrupt header (starting from file header): hdr_start

PE-sieve was able to find some artefacts: However, if failed to reconstruct the PE.

bartblaze commented 5 years ago

Was going to open an issue about this over the weekend, but seems like you already identified it :smile:

Another sample if needed: a28b197f2cf9d82101980e302f16732fd09eb9b4760e13699a3c0d2c6cd18cc3

For me, pe-sieve crashes as soon as it starts scanning the memory regions.

OS: Windows 7 x86 pe-sieve v0.1.6

Seems like header is corrupted and RVA can't be fetched.

hasherezade commented 5 years ago

@bartblaze - the crash was another issue (https://github.com/hasherezade/pe-sieve/issues/28), and I already fixed it, please check the latest builds and let me know if it works for you: https://github.com/hasherezade/pe-sieve/blob/master/README.md It will be in the official release soon.

bartblaze commented 5 years ago

Thanks @hasherezade, I can confirm that solved the crashing issue. (and thanks for a great tool!)

hasherezade commented 5 years ago

Result: the payload got shifted (to make space for the DOS header), realigned to Virtual (because of damaged raw headers) and dumped: result1 Report: report