PepiMK
2008-07-31, 12:02
Situation: FileAlyzer displays information about file structures. Is used in malware analysis.
Experienced: some files have clear indicators that things are "wrong".
Expected: new tab Anomalies that summarizes unexpected information.
1. PE sections that do have a physical size of 0.
2. PE sections that are marked as writable and executable.
3. PE code sections that are marked as writable.
4. PE header checksums that do not match the file contents checksums.
5. UPX structure analyzis failure reasons.
Feel free to suggest more anomalies you want reported.