1

I am reverse engineering some malware that is written in VB6. I found this tool which tried to decompile the .exe, but I noticed that the image that is being loaded by the .exe is suspicious and I want to extract it for further analysis.

Someone mentioned resource extractor would work, but that only pulls the ICON from the file, not the image below.

Is there a technique or tool that will extract this image?

Image that I want to extract Here is some somewhat related topics that have brought me thus far.

How to disassemble VBX files?

Improve this question
10
  • If this tool provides any info about the offset(there are some that looks like that in the bottom two) at which this "image" is located you can just write a simple script that will copy bytes from that offset and save them into a separate file.
    – Paweł Łukasik
    Commented May 4, 2019 at 15:04
  • Yeah I might have to do that. I would like to avoid it though . I dint think this tool tells this information though. The pro edition of this tool allows swapping of images so maybe I can swap images and the do a bindiff... Just thinking though.
    – LUser
    Commented May 4, 2019 at 16:01
  • I would say this way is preferred. You don't know what kind of processing the tool might do when extracting the bitmap.
    – Paweł Łukasik
    Commented May 4, 2019 at 17:03
  • 1
    I just need to find the image point if it is an image or posing as one
    – LUser
    Commented May 4, 2019 at 17:07
  • 1
    it's a common practice to hide some code this way only xor'ed with a key.
    – Paweł Łukasik
    Commented May 4, 2019 at 19:52

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.