I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the decryption routine.
My first attempt was identifying uses and locations in the x86 for VirtualAlloc
as I know memory will need to be allocated to perform the decryption. Is there anything else I should look for at the x86 level for code that will attempt to access this PE overlay?