I’m reviewing a malware sample that stores an encrypted PE file in its overlay. I’m attempting to identify in IDA pieces of x86 that may be responsible for accessing the overlay and performing the decryption routine.
My first attempt was identifying uses and locations in the x86 for
VirtualAlloc as I know memory will need to be allocated to perform the decryption. Is there anything else I should look for at the x86 level for code that will attempt to access this PE overlay?