Support applications packed by Crinkler

hasherezade / pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

https://hshrzd.wordpress.com/pe-sieve/

BSD 2-Clause "Simplified" License

3.01k stars 421 forks source link

Support applications packed by Crinkler #46

Closed hasherezade closed 4 years ago

hasherezade commented 4 years ago

Test case

crinkler_demo.zip - c44a57b69ed73cd585032d60be395f3389133f68852b18ad7e3007682e60be87 - Flare-On 2019, task: Demo

This task is packed by Crinkler packer: http://crinkler.net/ The PE has atypical alignment: no sections. PE-sieve should detect and dump it like any other packed app.

hasherezade commented 4 years ago

Solved in v0.2.7