Timeline for How can I extract resource images from Visual Basic 6 Malware
Current License: CC BY-SA 4.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 8, 2019 at 8:38 | comment | added | ismael_akez | What is tool is this? | |
| May 5, 2019 at 16:50 | comment | added | LUser | I think under normal circumstances John's tool would have worked. I ended up using some online tool image from binary extrator tool | |
| May 5, 2019 at 16:35 | comment | added | s3c | Which tool is this? | |
| May 5, 2019 at 8:25 | comment | added | LUser | Thank you everyone . I will try the following from @John | |
| May 4, 2019 at 19:52 | comment | added | Paweł Łukasik | it's a common practice to hide some code this way only xor'ed with a key. | |
| May 4, 2019 at 18:51 | comment | added | John | Found this on the web Maybe it will work: sandsprite.com/blogs/index.php?uid=7%26pid=57 | |
| May 4, 2019 at 17:07 | comment | added | LUser | I just need to find the image point if it is an image or posing as one | |
| May 4, 2019 at 17:03 | comment | added | Paweł Łukasik | I would say this way is preferred. You don't know what kind of processing the tool might do when extracting the bitmap. | |
| May 4, 2019 at 16:01 | comment | added | LUser | Yeah I might have to do that. I would like to avoid it though . I dint think this tool tells this information though. The pro edition of this tool allows swapping of images so maybe I can swap images and the do a bindiff... Just thinking though. | |
| May 4, 2019 at 15:05 | history | edited | Paweł Łukasik | CC BY-SA 4.0 |
spelling corrections
|
| May 4, 2019 at 15:04 | comment | added | Paweł Łukasik | If this tool provides any info about the offset(there are some that looks like that in the bottom two) at which this "image" is located you can just write a simple script that will copy bytes from that offset and save them into a separate file. | |
| May 4, 2019 at 7:23 | history | asked | LUser | CC BY-SA 4.0 |