Skip to content

Issue with Malformed PE Files #11

@IneeddHelp

Description

@IneeddHelp

When run on files received from dd-run with malware-bazaar, LIEF is unable to parse the samples, returning None after calling lief::Binary::from. However, when tested on malware I got from a GitHub repo, it runs fine. 2 parts to this issue

  1. Why? I assume because of a malformed DOS header, in which case, it should be safe to assume the file is malicious (I think). But I am not completely sure. Or is it possibly something weird or unique about the sample source?

  2. How should this be handled? Should the file be skipped? Should the row say something about it in the csv? Up for discussion

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinggood first issueGood for newcomersquestionFurther information is requested

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions