The packer loads a shellcode containing a PE in the memory. PE-sieve run with the option /shellc detects the loaded shellcode. However, it misses to detect and extract the PE file that is embedded there. A view from Process Hacker:
PE-sieve run without any parameters does not detect the payload at all.
Test case
85a6aa581ffa0514149f3267c41681d27600adbe6ca7b35ee328ec3b3d9f749c - a KrugBot sample
Problem
The packer loads a shellcode containing a PE in the memory. PE-sieve run with the option
PE-sieve run without any parameters does not detect the payload at all.
/shellc
detects the loaded shellcode. However, it misses to detect and extract the PE file that is embedded there. A view from Process Hacker: