Unpacking NSPack v 2.9 based malware to get OEP

Question

recently i am analyzing a malware which is packed with NSPack. when i am trying to unpack it using this blog link,i landed over two instruction PUSHFD,PUSHAD in ollydbg. so i put a breakpoint on the jmp instruction which will do unpack

004DF425                       9D              POPFD
004DF426                      -E9 A5D4FFFF     JMP 5df0b1b0.004DC8D0

after stepover, i have landed over below instruction which is not start of a pe file

004DC8D0                         60            DB 60                               ;  CHAR '`'
004DC8D1                         BE            DB BE
004DC8D2                         00            DB 00
004DC8D3                         20            DB 20                               ;  CHAR ' '
004DC8D4                         4C            DB 4C                               ;  CHAR 'L'
004DC8D5                         00            DB 00
004DC8D6                         8D            DB 8D
004DC8D7                         BE            DB BE
004DC8D8                         00            DB 00
004DC8D9                         F0            DB F0
004DC8DA                         F3            DB F3
004DC8DB                         FF            DB FF
004DC8DC                         57            DB 57                               ;  CHAR 'W'
004DC8DD                         83            DB 83
004DC8DE                         CD            DB CD

the above instruction is very strange i should expect instruction like

PUSH EBP
PUSH EBP,ESP

so how can i unpack the malware and where i am wrong during unpacking.Help will be appreciated Hash of malware:59c661ba0c7c485f4480f7b142a9c084

Answer 1

The blog post to which you linked has incorrect information. 0x004DC8D0 is not the OEP. Rather, 0x0041A4E3 is the OEP.

After reaching 0x004DC8D0, right-click on the machine code in the disassembly pane and select Analysis → Remove analysis from module. Then scroll down a bit to 0x004DCA84; you'll see there's a JMP from that address to 0x0041A4E3, which is the correct OEP:

Answer 2

so ollydbg didn't understand the code put unnecessary code.so after doing "Remove analysis" from the assembly pane i got OEP Now NS based packed got unpacked Thanks @jason Geffner