I need to analyze a memory dump of a malware module, unfortunately the sample is not the original dll, but the dump of the dll from the memory.
Now fixing the sections headers is fairly easy - i just need to match the Virtual address \ size to the Raw address \ size because this is what the PE will get once loaded to memory (Which is the case for the dump)
But now there is a different problem, when i open the file on IDA-PRO for example, the memory isnt aligned correctly thus the analysis is incorrect and not all call functions with relative addresses work properly (they dont point to the right location - or to a location which makes sense in terms of PE size)
I feel like the solution of Re-basing the PE on ida is incomplete and does not fix everything as i need it to be. Also i would like to fix the PE so i can dynamically load it later with ollydbg (as if i had the original)
So my question is: How exactly would you recommend me to fix the PE Headers and Rebase the program so i can load it successfully?
For the VirusTotal-Intelligence users, the Sample MD5 is: 3bb85abe51b0f96f501d2bb32ec4edef SHA256: 83c95637712cacc0ca280892465a75a3a10a2d8df48dd816ae703bccb15db51d
Samples: https://www.hybrid-analysis.com/search?query=vxfamily%3AGen:Variant.Terkcop
2015_12_08_ExtraInfo: @ubnix, I havent yet read the content of the materials you sent me, but im much aware of the importance of IAT - By the way this is exactly the problem when im loading the file on IDA.
The dll is being loaded at address 0x10000000 (Thus every section is loaded at 0x10001000 - depending on size and so on respectively, 0x10000000 and forward.)
The code of the malware is expecting the IAT to be located at 0x05320000, which is not the case obviously. When i try on IDA-PRO to change the location of the IAT Segment (Ctrl + S or ALT + S if i recall) it is crashing my IDA client.
Obviously changing the Address would only work as a temporary solution to see the malware statically on IDA pro and not as a solution to run the malware with ollydbg. If i would want to run the malware with olly, i need to somehow make the dll run under the correct address of 0x5320000
When changing the BaseAddress of the PE from 0x10000000 to the address i want (Using CFF Explorer), it is still being loaded at 0x10000000 at ollydbg.. no idea why
Edit2 2015_12_15: Example of a sample i "fixed" his headers, yet its still not working properly (Problems with all CRT fucntions)
The original sample: https://www.hybrid-analysis.com/sample/53dd790b1bd0588e542d33bde49dbf33c6fb7828e91a8d13c416c831108d642c?environmentId=1
After i fixed the sample: https://www.dropbox.com/s/6dz7athzdja94p4/53_fixed_rebase.dll?dl=0
Please note that both of these files are samples of malware and might cause antivirus to alert.
The sample i fixed is definitely working more properly, and ida can instantly recognize all the functions - yet i think i missed something, because only the CRT functions or functions such as "Init operation" (Like c++ classes initialization) are failing.
