1

I have pulled bunch of files from Virus Total based on hashes, one sample (SHA256 == 3e6ee07c883a6a0e939300a18c61d639a0dea49521037fef09ae77b76f70f843) was really weird.

Basically it is PE file (*.exe file to be more precise), however first two bytes in file are SR instead of MZ.

Have been looking online if it can be some magic that can be executed in Windows machines but no success. I guess it is some kind of corrupted file, however not sure, so asking if someone has any references to SR files.

Improve this question

1 Answer 1

Reset to default
4

Probably it's just a measure to prevent scanning of the file by standard antiviruses. I suspect the malware either restores MZ before actually running the file, or uses a custom loader (a la RunPE) to map and execute it, and of course the custom loader can be coded to handle the SR signature in addition (or instead of) MZ.

Improve this answer
2
  • Just had a look at that file, changing SR to MZ makes the file work (can be loaded and recognized by pe tools)
    – Sigtran
    Commented Nov 2, 2016 at 13:10
  • Make sense, however that file looks legit and custom loader and AV scanning prevention is weird for legit files.
    – ST3
    Commented Nov 2, 2016 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.