Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Using IDAPython to Make Your Life Easier: Part 5

Summary: Unit 42's fifth IDAPython tutorial shows analysts how to automatically extract embedded executables from malware samples by searching for the static MZ header string "This program cannot be run in DOS mode" with IDA's FindBinary() function in a loop, then confirming the 'MZ' characters at the known offset. The script uses the third-party pefile library to parse the Optional Header's 'SizeOfHeaders' plus each section's 'SizeOfRawData' to calculate the embedded PE's size, requiring the analyst to manually append PIP's 'site-packages' directory to the Python environment variable first.

What you should know: Malware routinely hides executables in overlays, PE resources, or in-memory buffers, and the manual alternatives - running the sample and breaking after extraction, or highlighting hex and saving by hand - each carry their own limits; automating the pull saves analysts time on a task they face almost daily.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related