modules/pe: Added detection of additional characters in section names (#1530)
modules/pe: Added detection of additional characters in section names (#1530)

after the first null

There are certain samples like 0043812838495a45449a0ac61a81b9c16eddca1ad249fb4f7fdb1c4505e9bb34
which contain section names with additional characters after the first
null. This is an useful information which can be used to detect such
anomalies. YARA is not able to process those even though VirusTotal web interface is able to detect them.

PE specification states that section name is "An 8-byte, null-padded UTF-8 encoded string. If the string is exactly 8 characters long, there is no terminating null.".
If you however consider the first null as the terminator then
null-padding requirement from PE specification is not adhered. If you
what we are doing in this commit then you are also going against the
specification because we are not honoring the fact that those strings
are null-terminated. We however found that having more information is
more useful than having less information, hence this PR.

The change is made with backward compatibility in mind so for vast
majority of samples, nothing changes. Their section names will remain
the same. It only affect such weird samples like the one mentioned above
so even though it might break some rules on some specific samples, it
shouldn't really affect anyone that much.
VirusTotal/yara,VirusTotal/yara,pombredanne/yara,VirusTotal/yara,pombredanne/yara,VirusTotal/yara,wxsBSD/yara,hillu/yara,hillu/yara,pombredanne/yara,wxsBSD/yara,pombredanne/yara,VirusTotal/yara,hillu/yara,wxsBSD/yara,pombredanne/yara,hillu/yara,wxsBSD/yara,wxsBSD/yara,hillu/yara