I added a feature to my tool pecheck.py to help extract embedded PE files from any host file: -l –locate.
pecheck.py expects a PE file as input, but if you use option -l P, it will read any file an look for embedded PE files by searching for a DOS header (MZ) followed by a PE header, that can then be parsed by pefile without errors.
Like in this example, where I created a PNG file with a 32-bit and a 64-bit DLL appended:
One PE file can then be selected for further analysis:
Or for extraction:
Here is a video with more details:
Didier Stevens 
Leave a Reply (comments are moderated)