Recognizing and reconstrucing a PE with partialy erased headers

[hasherezade]

• Some of the malware packers/protectors erase PE headers of the payload to evade automated unpackers. The header can be erased in fragments or fully. Examples:
  • Princess Locker: https://www.virustotal.com/#/file/b07c1eb438ea06719492576d60b562c7184a231ba0cc3dbee8a211a03b29b548
  • Korplug: https://blog.malwarebytes.com/threat-analysis/2016/08/unpacking-the-spyware-disguised-as-antivirus/
  • Smoke Loader: https://blog.malwarebytes.com/threat-analysis/2016/08/smoke-loader-downloader-with-a-smokescreen-still-alive/
• PE-sieve's scanner should be able to recognize that the particular memory area contains a PE file, even if the header was removed
• PE-sieve (or libPeConv ?) should be able to reconstruct a valid header before the PE is dumped