0

I've found what appears to be Base64 inside of a PE header resource (.rsrc) which I've placed in this Gist.

However, if I use a Base64 decoder, I end up getting a lot of binary data which appears as "gibberish" in the Base64 decoder web app. This means that either it is not Base64, it is modified Base64 OR it is deciphered to binary data (an embedded PE file).

I am not sure how to take that binary data and parse it into its own separate PE file. I'm only familiar with Base64 when it comes to ASCII text. I've tried copying the data and pasting into a hex editor like HxD and WinHex but neither have allowed me to paste the decoded data in.

1
  • Did you ever figure out how to decode this? – seebiscuit May 23 '18 at 0:17
2

This is indeed base64 encoded string, it cannot possibly be so long and randomly follow the base64 acceptable characters and = padding.

The best way to figure out how that base64 decoded data is used is obviously to reverse engineer the code in charge of reading that data. There are only a handful of resource reading APIs which are most likely used to get a mapping of the resource by the executable.

After running base64 decoding on the entire string, this does look like a compress/encrypted message with an header. I couldn't recognize the header itself, so your best bet is indeed to reverse engineer the code processing the resource.

Also please not this does not necessarily mean there's a PE file hidden there, it could just as well be a configuration (either enrypted, compressed or both), an inject-able piece of code, or an actual resource such as an HTML or JPG.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.