The malware is packed w/ UPX - can see 0/1 in sections.
Sure, I can can a tool or even use UPX -d -o flags .exe to create an unpacked copy with a >97% ratio, however I want to MANUALLY unpack it to keep practicing my skills and to get better.
Opening the .exe (MD5 for malware: 9fbdc5eca123e81571e8966b9b4e4a1e) with OllyDbg brings us right to the POPAD instruction and several usual follow-on calls on the stack that also let us know it's typical UPX stuff.
The problem is, when I step-over the PUSHAD and land on the MOV instruction, if I follow the ESP register through the dump, the first four hex dump bytes are zeroed out.
With this said, I still set the HWBP on access just to see what it would lead me to, and it brings me to this:
And this is where I get stumped. If I try and step through to the JUMP instruction, it will only go to the conditional jump (JNZ) before it falls back to the PUSH instruction. I can manually click my way to the JMP instruction and run the program again, which leads me to the CMP ESP, EAX. If I run the program one more time, it brings me to 0139BC0E which looks like this:
There's a few kernel32 function calls that you might see at the beginning of a program, but honestly I am not sure if I am where I need to be for this unpacking. I doubt it.
All in all, I could use some help.