How can I know what the executable is missing to run?

Question

I have extracted a presence of MZ file from memory which happen to be available in VirusTotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing resources. It claims that the debug information is missing, and the PDB is incomplete (Executable compiled with Visual Studio). I am still a beginner and I am wondering if that is truly relevant for the program not being able to run? I thought that the debug information is not necessary to run a program, am I correct? I have an assumption that the program is flagged somewhere to make it act as in debugging mode until it receives something? Not sure if my assumption is even possible.

If anyone can direct me by answering my questions or advising me where to look to find what is missing. Even answering by saying my claim is irrelevant can also help me a lot.

Answer 1

Typically I would load the binary into a PE editor and see if it looks good. You could load it into LordPE and click around and see if it throws an error. Open the import browser in LordPE and see if it complains, open the resource table, look at the section data.

You can then also jump to the entry point code and see if it looks reasonable.

That said, if you extracted the binary from memory and it has been actually loaded, it very likely needs some light fixups to turn it into a proper executable.

The reason is loading a PE file alters the layout a bit compared to PE files on disk (file alignment vs. section alignment), but loading a memory dump into a PE editor is quickly revealed as described above, LordPE won't be able to properly show the import table, code at the entry point won't make sense and so on.