0

I have extracted a presence of MZ file from memory which happen to be available in virustotal ( might be a malicious executable). However, I could not run the program. It seems to have some missing resources. It claims that the debug information is missing, and the PDB is incomplete (Executable compiled with visualstudio). I am still a beginner and I am wondering if that is truly relevant for the program not being able to run? I thought that the debug information is not necessary to run a program, am I correct? I have an assumption that the program is flagged somewhere to make it act as in debugging mode until it receives something? Not sure if my assumption is even possible.

If anyone can direct me by answering my questions or advising me where to look to find what is missing. Even answering by saying my claim is irrelevant can also help me alot.

Thank you

0

Typically I would load the binary into a PE editor and see if it looks good. You could load it into LordPE and click around and see if it throws an error. Open the import browser in LordPE and see if it complains, open the resource table, look at the section data.

You can then also jump to the entry point code and see if it looks reasonable.

That said, if you extracted the binary from memory and it has been actually loaded, it very likely needs some light fixups to turn it into a proper executable.

The reason is loading a PE file alters the layout a bit compared to PE files on disk (file alignment vs. section alignment), but loading a memory dump into a PE editor is quickly revealed as described above, LordPE won't be able to properly show the import table, code at the entry point won't make sense and so on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.