7

I need to analyze a memory dump of a malware module, unfortunately the sample is not the original dll, but the dump of the dll from the memory.

Now fixing the sections headers is fairly easy - i just need to match the Virtual address \ size to the Raw address \ size because this is what the PE will get once loaded to memory (Which is the case for the dump)

But now there is a different problem, when i open the file on IDA-PRO for example, the memory isnt aligned correctly thus the analysis is incorrect and not all call functions with relative addresses work properly (they dont point to the right location - or to a location which makes sense in terms of PE size)

I feel like the solution of Re-basing the PE on ida is incomplete and does not fix everything as i need it to be. Also i would like to fix the PE so i can dynamically load it later with ollydbg (as if i had the original)

So my question is: How exactly would you recommend me to fix the PE Headers and Rebase the program so i can load it successfully?

For the VirusTotal-Intelligence users, the Sample MD5 is: 3bb85abe51b0f96f501d2bb32ec4edef SHA256: 83c95637712cacc0ca280892465a75a3a10a2d8df48dd816ae703bccb15db51d

Samples: https://www.hybrid-analysis.com/search?query=vxfamily%3AGen:Variant.Terkcop

2015_12_08_ExtraInfo: @ubnix, I havent yet read the content of the materials you sent me, but im much aware of the importance of IAT - By the way this is exactly the problem when im loading the file on IDA.

The dll is being loaded at address 0x10000000 (Thus every section is loaded at 0x10001000 - depending on size and so on respectively, 0x10000000 and forward.)

The code of the malware is expecting the IAT to be located at 0x05320000, which is not the case obviously. When i try on IDA-PRO to change the location of the IAT Segment (Ctrl + S or ALT + S if i recall) it is crashing my IDA client.

Obviously changing the Address would only work as a temporary solution to see the malware statically on IDA pro and not as a solution to run the malware with ollydbg. If i would want to run the malware with olly, i need to somehow make the dll run under the correct address of 0x5320000

When changing the BaseAddress of the PE from 0x10000000 to the address i want (Using CFF Explorer), it is still being loaded at 0x10000000 at ollydbg.. no idea why

Edit2 2015_12_15: Example of a sample i "fixed" his headers, yet its still not working properly (Problems with all CRT fucntions)

The original sample: https://www.hybrid-analysis.com/sample/53dd790b1bd0588e542d33bde49dbf33c6fb7828e91a8d13c416c831108d642c?environmentId=1

After i fixed the sample: https://www.dropbox.com/s/6dz7athzdja94p4/53_fixed_rebase.dll?dl=0

Please note that both of these files are samples of malware and might cause antivirus to alert.

The sample i fixed is definitely working more properly, and ida can instantly recognize all the functions - yet i think i missed something, because only the CRT functions or functions such as "Init operation" (Like c++ classes initialization) are failing.

5

This would be a comment but since I still don't have enough reputation for comments, I will leave it as an answer:

For a dump to work correctly, there are a couple of more things you need to do besides fixing the section headers:

I know I just posted a lot of material to read but believe me, I am talking from my personal experience, and these resources are a must if You want to understand the PE file format and the procedure of dumping PE files correctly. If you have any more questions feel write to ask and I will answer ASAP.

  • i've changed my question and added some more information about the problem – RE-Beginner Dec 8 '15 at 16:30
  • @RE-Beginner: DLLs are usually compiled with ASLR enabled. Check the Characteristics field in the IMAGE_FILE_HEADER to see does it contain the IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE flag. What this means is that the DLL will be loaded on a random address in memory and for it to work correctly, the relocation table must be specified and correct. So, is the relocation table specified in your malware sample? – ubnix Dec 9 '15 at 9:06
  • No this is not the case, also my reversing environment is set on windows XP, so it shouldnt effect me – RE-Beginner Dec 10 '15 at 7:02
  • @RE-Beginner: could you upload the sample? – ubnix Dec 10 '15 at 9:09
  • yes i've added a way to download the sample on my message hybrid-analysis.com/search?query=vxfamily%3AGen:Variant.Terkcop – RE-Beginner Dec 10 '15 at 9:40
1

open the dumped file in a hexeditor say hxd
select the bytes from offset 0x400 to 0xfff and delete them
(all the bytes would be 0x00)
save the file your imports should turn out ok
pointer to raw data would normally be 0x400
but since this is a memory as you say the pe header would be 0x1000 bytes deleting the extra bytes should align the text segment as well as entry point to correct place

if there are any misalignments further down in other sections you may need to trim the extra 00000 bytes based on size of raw data + pointer to raw data this should normally match the next sections pointer to raw data

  • What i would usually do, instead of deleting the zero-bytes was to change to PE header to match that extra offset - so instead of having a raw-size of 0x400, i would change it to 0x1000 and it would fix the problem (so far) I havent tried what u suggested yet, but i dont think its any different! Will come back later with results – RE-Beginner Dec 13 '15 at 7:29
  • any idea why only the crt functions are not working properly on ollydbg? – RE-Beginner Dec 17 '15 at 7:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.