PeNet icon indicating copy to clipboard operation
PeNet copied to clipboard

Published 20 hours ago • verified publisher icon secana

Check discarding some resources

Open Lifka opened this issue 2 years ago • 2 comments

Hi,

the following check causes less resources to be obtained:

https://github.com/secana/PeNet/blob/05133c9692d20be2f951cf22ba6d951f0bd810f6/src/PeNet/HeaderParser/Pe/ImageResourceDirectoryParser.cs#L40-L42

For example, for the sample aafee478d8d65eea241b1f01c0af10fa2181f7301776438d2b7a2f146f9dfc5a PeNet gets only 30 resources, while other tools like pestudio, VirusTotal or Resource Hacker get 37.

Is there a good reason to discard these resources?

Lifka avatar Mar 29 '22 10:03 Lifka

Hi @Lifka, sry I don't have access to that specific file to check what's going on. Could you share it with me?

secana avatar Apr 04 '22 12:04 secana

Sure! Sorry, this is the sample --> https://mega.nz/file/A1MB1BQZ#X2lY4cvLhr8kz0XhgFhU0VkXRKBt66xthXUThf036X4 (aafee478d8d65eea241b1f01c0af10fa2181f7301776438d2b7a2f146f9dfc5a).

Be careful! Do not execute, it's a malware. Zip password: infected

Lifka avatar Apr 04 '22 21:04 Lifka