issues
search
hasherezade
/
pe-sieve
Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
https://hshrzd.wordpress.com/pe-sieve/
BSD 2-Clause "Simplified" License
3.03k
stars
423
forks
source link
Recognizing and reconstrucing a PE with partialy erased headers
#7
Closed
hasherezade
closed
5 years ago
hasherezade
commented
6 years ago
Some of the malware packers/protectors erase PE headers of the payload to evade automated unpackers. The header can be erased in fragments or fully. Examples:
Princess Locker:
https://www.virustotal.com/#/file/b07c1eb438ea06719492576d60b562c7184a231ba0cc3dbee8a211a03b29b548
Korplug:
https://blog.malwarebytes.com/threat-analysis/2016/08/unpacking-the-spyware-disguised-as-antivirus/
Smoke Loader:
https://blog.malwarebytes.com/threat-analysis/2016/08/smoke-loader-downloader-with-a-smokescreen-still-alive/
PE-sieve's scanner should be able to recognize that the particular memory area contains a PE file, even if the header was removed
PE-sieve (or libPeConv ?) should be able to reconstruct a valid header before the PE is dumped