I am reverse engineering some malware that is written in VB6. I found this tool which tried to decompile the .exe, but I noticed that the image that is being loaded by the .exe is suspicious and I want to extract it for further analysis.

Someone mentioned resource extractor would work, but that only pulls the ICON from the file, not the image below.

Is there a technique or tool that will extract this image?

Image that I want to extract Here is some somewhat related topics that have brought me thus far.

How to disassemble VBX files?

  • If this tool provides any info about the offset(there are some that looks like that in the bottom two) at which this "image" is located you can just write a simple script that will copy bytes from that offset and save them into a separate file. – Paweł Łukasik May 4 '19 at 15:04
  • Yeah I might have to do that. I would like to avoid it though . I dint think this tool tells this information though. The pro edition of this tool allows swapping of images so maybe I can swap images and the do a bindiff... Just thinking though. – LUser May 4 '19 at 16:01
  • I would say this way is preferred. You don't know what kind of processing the tool might do when extracting the bitmap. – Paweł Łukasik May 4 '19 at 17:03
  • 1
    I just need to find the image point if it is an image or posing as one – LUser May 4 '19 at 17:07
  • 1
    it's a common practice to hide some code this way only xor'ed with a key. – Paweł Łukasik May 4 '19 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.