in icedid/photoloader/icedid_photoloader.py [0:0]
def extractPayload(pe: PE) -> bytes:
"""
Extracting the payload from the .data section
"""
for section in pe.sections:
if ".data" in str(section.Name):
data = section.get_data()
payload = asciiz(data[4:])
return payload
return b""