Carving PE Files With pecheck.py

Malware Analysis
1

I added a feature to my tool pecheck.py to help extract embedded PE files from any host file: -l –locate.

pecheck.py expects a PE file as input, but if you use option -l P, it will read any file an look for embedded PE files by searching for a DOS header (MZ) followed by a PE header, that can then be parsed by pefile without errors.

Like in this example, where I created a PNG file with a 32-bit and a 64-bit DLL appended:

994×179

One PE file can then be selected for further analysis:

994×244

Or for extraction:

994×527

Here is a video with more details:

Article Link: https://blog.didierstevens.com/2020/03/27/carving-pe-files-with-pecheck-py/