Cobalt Strike shellcode seems to be recognized as PE about pezor

[zanemendoza123]

Would like to close this issue since the CLI option -shellcode fixed it.

[zanemendoza123]

Managed to make it work by setting the IS_SHELLCODE variable to true. I'm not sure if this is the right fixed for my issue though. I'm not knowledgeable enough to debug all codes. I might I have broke something.

[phra]

[?] PE detected: beacon.bin: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

it seems that file, used by PEzor, recognizes your input as a PE file instead of raw shellcode. can you check why file believes that?

[zanemendoza123]

Here's the output of file command on the raw shellcode

# file beacon.bin    
beacon.bin: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

[phra]

based on https://malware.news/t/cobaltstrike-beacon-dll-your-no-ordinary-mz-header/34458 it seems that cobalt strike generates a shellcode that starts with a specially crafted DOS header and file reports it as a full PE based on that header. (https://github.com/phra/PEzor/blob/master/PEzor.sh#L222)

if confirmed, a solution would be to add a new command-line option to force the payload to be treated as raw shellcode despite the file output. anyway this issue doesn't appear when using hooks to customize generated artifacts.

[c14dd49h]

I have the same issue... any update of this topic?

[phra]

a workaround was posted by @zanemendoza123 above and a long-term solution was suggested by me. unfortunately i haven't worked on it, does someone mind to send a PR with the proposed fix? (i.e. add -shellcode command line option)