4

I have an exe application that contains three files packed in it. I know how those files were named before packing, I have around 80% of packed files and some of main executable file binary code. I've also found out that the execution creates and uses two files in \AppData\Local\Temp\ called MBX@pid@3bytes.### which contains application entry I believe. And when I scan the file header with PEiD I get Nothing found [Overlay] *.

Thats my objdump result

application.exe:     file format pei-i386
architecture: i386, flags 0x00000102:
EXEC_P, D_PAGED
start address 0x0083db33

Characteristics 0x30f
    relocations stripped
    executable
    line numbers stripped
    symbols stripped
    32 bit words
    debugging information removed

Time/Date       Tue Dec  8 10:45:51 2009
Magic           010b    (PE32)
MajorLinkerVersion  6
MinorLinkerVersion  0
SizeOfCode      00000000
SizeOfInitializedData   00150000
SizeOfUninitializedData 00000000
AddressOfEntryPoint 0043db33
BaseOfCode      0043c000
BaseOfData      001b2000
ImageBase       00400000
SectionAlignment    00001000
FileAlignment       00001000
MajorOSystemVersion 4
MinorOSystemVersion 0
MajorImageVersion   0
MinorImageVersion   0
MajorSubsystemVersion   4
MinorSubsystemVersion   0
Win32Version        00000000
SizeOfImage     00457000
SizeOfHeaders       00001000
CheckSum        00000000
Subsystem       00000002    (Windows GUI)
DllCharacteristics  00000000
SizeOfStackReserve  00100000
SizeOfStackCommit   00001000
SizeOfHeapReserve   00100000
SizeOfHeapCommit    00001000
LoaderFlags     00000000
NumberOfRvaAndSizes 00000010

The Data Directory
Entry 0 00000000 00000000 Export Directory [.edata (or where ever we found it)]
Entry 1 0044eb2c 0000003c Import Directory [parts of .idata]
Entry 2 003dc000 0005e81a Resource Directory [.rsrc]
Entry 3 00000000 00000000 Exception Directory [.pdata]
Entry 4 00000000 00000000 Security Directory
Entry 5 00000000 00000000 Base Relocation Directory [.reloc]
Entry 6 00000000 00000000 Debug Directory
Entry 7 00000000 00000000 Description Directory
Entry 8 00000000 00000000 Special Directory
Entry 9 00000000 00000000 Thread Storage Directory [.tls]
Entry a 00000000 00000000 Load Configuration Directory
Entry b 00000000 00000000 Bound Import Directory
Entry c 0044e000 0000005c Import Address Table Directory
Entry d 0022c5f8 00000060 Delay Import Directory
Entry e 00000000 00000000 CLR Runtime Header
Entry f 00000000 00000000 Reserved

There is an import table in 6 at 0x84eb2c

The Import Tables (interpreted 6 section contents)
 vma:            Hint    Time      Forward  DLL       First
                 Table   Stamp     Chain    Name      Thunk
 0044eb2c   0044eb68 00000000 00000000 0044ecb8 0044e000

    DLL Name: KERNEL32.dll
    vma:  Hint/Ord Member-Name Bound-To
    44ebc4    537  InitializeCriticalSection
    44ebe0    408  GetProcAddress
    44ebf2    594  LocalFree
    44ebfe    667  RaiseException
    44ec10    590  LocalAlloc
    44ec1e    375  GetModuleHandleA
    44ec32    583  LeaveCriticalSection
    44ec4a    143  EnterCriticalSection
    44ec62    429  GetShortPathNameA
    44ec76    709  ResumeThread
    44ec86    925  WriteProcessMemory
    44ec9c    400  GetPrivateProfileSectionA
    44ed52    434  GetStringTypeA
    44ed42    571  LCMapStringW
    44ed32    570  LCMapStringA
    44ecfa    714  RtlUnwind
    44ed06    903  WideCharToMultiByte
    44ed1c    619  MultiByteToWideChar
    44ed64    437  GetStringTypeW

 0044eb40   0044ebb8 00000000 00000000 0044ecee 0044e050

    DLL Name: USER32.dll
    vma:  Hint/Ord Member-Name Bound-To
    44ecc6    142  DefWindowProcA
    44ecd8      2  AdjustWindowRectEx

 0044eb54   00000000 00000000 00000000 00000000 00000000

Sections:
Idx Name          Size      VMA       LMA       File off  Algn
  0 0             000b7000  00401000  00401000  00001000  2**2
                  CONTENTS, ALLOC, LOAD, CODE, DATA
  1 1             00029000  005b2000  005b2000  000b8000  2**2
                  CONTENTS, ALLOC, LOAD, CODE, DATA
  2 2             00001000  0062f000  0062f000  000e1000  2**2
                  CONTENTS, ALLOC, LOAD, CODE, DATA
  3 3             0005e81a  007dc000  007dc000  000e2000  2**2
                  CONTENTS, ALLOC, LOAD, CODE, DATA
  4 4             00001000  0083b000  0083b000  00141000  2**2
                  CONTENTS, ALLOC, LOAD, CODE, DATA
  5 5             0000c000  0083c000  0083c000  00142000  2**2
                  CONTENTS, ALLOC, LOAD, CODE, DATA
  6 6             00000d76  0084e000  0084e000  0014e000  2**2
                  CONTENTS, ALLOC, LOAD, CODE, DATA
  7 7             00002000  0084f000  0084f000  0014f000  2**2
                  CONTENTS, ALLOC, LOAD, CODE, DATA

The result I'm hoping for is extracted files that have been packed into the executable.

Update

I've used FastScanner 3.0 against the application and I've found out that it was packed just as the previous one, using MoleBox Pro. Here's all the FastScanner gueses (same as in previous app). FastScanner results

So everything seems to be just like it was, but the binary file is different and I can't unpack it in any way, when back in previous application it wasn't a problem at all. Molebox is long dead so I doubt it was packed by newer version. Also messing with ollydbg I've found out that the application have entry points on those two files that I've called before.

Improve this question
5
  • 2
    Aside from "the result you're hoping for", what have you tried? where are you stuck? What do you need help with?
    – NirIzr
    Commented Sep 3, 2017 at 14:20
  • 1
    I've tried to detect the packing program via PEiD but with no results. I've tried to determine if I can find raw packed files in the executable but its encrypted (packed). I have messed with ollydbg to find correct EPs but with no success. Also I've tried to use unpackers for common packing programs like molebox or UPX. I'm not very good at it thats why I've came here for help, I don't know what else I can do
    – erexo
    Commented Sep 3, 2017 at 14:41
  • 3
    Please elaborate as much as possible and in the question itself, and not in the comments, so as many people as possible will see the additional information.
    – NirIzr
    Commented Sep 3, 2017 at 14:44
  • 1
    Also explain how do you know there are three files packed into this executable.
    – Igor Skochinsky ♦
    Commented Sep 4, 2017 at 9:08
  • 1
    Because of I'm aware of what have been packed, I've unpacked it before but back then it was packed using molebox, PEiD showed me that in the header so I known how to work with it. Now it have been packed with unknown packer, thats why im so curious about it, but I'm stuck and I dont know how to deal with that. Also if "result I'm hoping for" sounded rude, my apologies, it wasn't my intention.
    – erexo
    Commented Sep 4, 2017 at 12:35

1 Answer 1

Reset to default
1

It turns out that the newer version was packed just as the previous one, using same Molebox Pro. But it was messing with PE Headers at runtime so I've needed to unwrap it from those masking layers first. Scylla was perfect tool for that.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.