recently i am analyzing a malware which is packed with NSPack.
when i am trying to unpack it using this blog link,i landed over two instruction
PUSHFD,PUSHAD in ollydbg.
so i put a breakpoint on the jmp instruction which will do unpack
004DF425 9D POPFD 004DF426 -E9 A5D4FFFF JMP 5df0b1b0.004DC8D0
after stepover, i have landed over below instruction which is not start of a pe file
004DC8D0 60 DB 60 ; CHAR '`' 004DC8D1 BE DB BE 004DC8D2 00 DB 00 004DC8D3 20 DB 20 ; CHAR ' ' 004DC8D4 4C DB 4C ; CHAR 'L' 004DC8D5 00 DB 00 004DC8D6 8D DB 8D 004DC8D7 BE DB BE 004DC8D8 00 DB 00 004DC8D9 F0 DB F0 004DC8DA F3 DB F3 004DC8DB FF DB FF 004DC8DC 57 DB 57 ; CHAR 'W' 004DC8DD 83 DB 83 004DC8DE CD DB CD
the above instruction is very strange i should expect instruction like
PUSH EBP PUSH EBP,ESP
so how can i unpack the malware and where i am wrong during unpacking.Help will be appreciated
Hash of malware: