diff --git a/README.md b/README.md index 8164e98..1b80133 100644 --- a/README.md +++ b/README.md @@ -115,9 +115,9 @@ Now the third, most interesting from perspective of this implementation, use cas Apart from the first IOC, considered somewhat _false positive_, we see a new one pointing that `kernel32.dll` memory was modified. However, no `Abnormal private executable memory` IOC this time. Our fluctuation (repeated encryption/decryption and memory protections flipping is active). -And for the record, `pe-sieve` has no issues with our fluctuating shellcode as well: +And for the record, `pe-sieve` also detects implanted PE when used with `/data 3` option (unless this option is given, no detection will be made): -![pe-sieve](images/pe-sieve2.png) +![pe-sieve](images/pe-sieve3.png) So we're able to see already that there are no clear references pointing back to our shellcode, at least memory IOC-wise. But what about that modified `kernel32` IOC? diff --git a/images/pe-sieve1.png b/images/pe-sieve1.png deleted file mode 100644 index f86208a..0000000 Binary files a/images/pe-sieve1.png and /dev/null differ diff --git a/images/pe-sieve2.png b/images/pe-sieve2.png deleted file mode 100644 index d4c55ba..0000000 Binary files a/images/pe-sieve2.png and /dev/null differ diff --git a/images/pe-sieve3.png b/images/pe-sieve3.png new file mode 100644 index 0000000..1236928 Binary files /dev/null and b/images/pe-sieve3.png differ