Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
IcedID PNG -> PE parser and reconstructor for custom steganographic loader
Py3 version of IcedID custom steganographic loader (PNG parser & PE reconstructor)
Inspired by
Authored by @nazywam and @psrok1.
pip3 install malduck lief
import sys
import malduck
from lief import PE
class IcedidSection(malduck.Structure):
_pack_ = 1
_fields_ = [
("VirtualOffset", malduck.DWORD),
("VirtualSize", malduck.DWORD),
("RawOffset", malduck.DWORD),
("RawSize", malduck.DWORD),
("Characteristics", malduck.BYTE)
class IcedidHeader(malduck.Structure):
_pack_ = 1
_fields_ = [
("ImageBase", malduck.QWORD),
("ImageSize", malduck.DWORD),
("EntryPoint_va", malduck.DWORD),
("ImportDir_va", malduck.DWORD),
("RelocDir_va", malduck.DWORD),
("RelocDir_size", malduck.DWORD),
("SectionCount", malduck.DWORD)
def decrypt_image(path: str) -> bytes:
p = malduck.procmem.from_file(path)
idat_off = next(p.findp(b'IDAT'))
idat_len = p.uint32p(idat_off - 4)
data = p.readp(idat_off + 4, idat_len)
decrypted = malduck.rc4(data[:8], data[8:])
return decrypted
def reconstruct(payload: bytes) -> bytes:
p = malduck.procmem(payload)
data_offset = offset = 0x1188
header_data = p.readp(offset, IcedidHeader.sizeof())
header = IcedidHeader.parse(header_data)
offset += IcedidHeader.sizeof()
sections_data = p.readp(offset, IcedidSection.sizeof() * header.SectionCount)
sections = [IcedidSection.parse(data) for data in malduck.chunks(sections_data, IcedidSection.sizeof())]
pe = PE.Binary('icedid_binary', PE.PE_TYPE.PE32)
pe.optional_header.imagebase = header.ImageBase
pe.optional_header.addressof_entrypoint = header.EntryPoint_va
sections = sorted(sections, key=lambda s: s.VirtualOffset)
for idx, sec in enumerate(sections):
section = PE.Section('')
content = p.readp(data_offset + sec.RawOffset, sec.RawSize)
section.content = list(content)
section.virtual_address = sec.VirtualOffset
section.characteristics = 0xE0000000
if idx != len(sections) - 1:
section.virtual_size = sections[idx + 1].VirtualOffset - sec.VirtualOffset
pe.data_directory(PE.DATA_DIRECTORY.IMPORT_TABLE).rva = header.ImportDir_va
pe.data_directory(PE.DATA_DIRECTORY.BASE_RELOCATION_TABLE).rva = header.RelocDir_va
pe.data_directory(PE.DATA_DIRECTORY.BASE_RELOCATION_TABLE).size = header.RelocDir_size
builder = PE.Builder(pe)
return bytes(builder.get_build())
if __name__ == '__main__':
if len(sys.argv) < 3:
print("Usage: ./ [pngfile] [outfile]")
inpath = sys.argv[1]
payload = decrypt_image(inpath)
data = reconstruct(payload)
with open(sys.argv[2], "wb") as f:
print("[*] Stored {} bytes in {}".format(len(data), sys.argv[2]))

This comment has been minimized.

Copy link

@r0ny123 r0ny123 commented Mar 31, 2020

Thanks for the script but it failed to parse this png file. Can you check that?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.