Failed reconstructing the payload (Ursnif)

[hasherezade]

Test case

633521d921ddad8671293319f0fd9daab9a0a606887ada3ab3709027cbb1e591

Problem

The payload has a partially corrupt header (starting from file header):

PE-sieve was able to find some artefacts:

However, if failed to reconstruct the PE.

[bartblaze]

Was going to open an issue about this over the weekend, but seems like you already identified it 😄

Another sample if needed:
a28b197f2cf9d82101980e302f16732fd09eb9b4760e13699a3c0d2c6cd18cc3

For me, pe-sieve crashes as soon as it starts scanning the memory regions.

OS: Windows 7 x86
pe-sieve v0.1.6

Seems like header is corrupted and RVA can't be fetched.

[hasherezade]

@bartblaze - the crash was another issue (#28), and I already fixed it, please check the latest builds and let me know if it works for you: https://github.com/hasherezade/pe-sieve/blob/master/README.md
It will be in the official release soon.

[bartblaze]

Thanks @hasherezade, I can confirm that solved the crashing issue. (and thanks for a great tool!)

[hasherezade]

Result: the payload got shifted (to make space for the DOS header), realigned to Virtual (because of damaged raw headers) and dumped:

Report: