Imports rebuilding - another issue with another sample of Trickbot about pe-sieve HOT 3 CLOSED

Thank you!
I didn't reproduce it so far, but looking at the output I think I found the root cause.
This is IAT in the original DLL -at RVA 75278C (bigger address):

And this is IAT found by PE-sieve - at RVA 71831C (smaller address):

The second one is not the original IAT, just a secondary IAT constructed for the functions that are loaded later. But PE-sieve stopped searching on this - and just tried to find an import table that could cover this IAT. However, such import table does not exist, so we have in logs:

[*] Trying to find ImportTable for module: 615c0000
[!] Overwriting IAT address!
[-] ImportTable NOT found!

It will be fixed soon, stay tuned!

from pe-sieve.

Please check the latest builds (attached to the README) and let me know if it helps.

from pe-sieve.

It helped, works fine now. Thanks!

from pe-sieve.