I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its decrypted version and do some processing on it. For this I took this polymorphic malware from offensive computing website.
http://oc.gtisc.gatech.edu:8080/search.cgi?search=bolzano MD5: 6eb5fdc7a80cb6b551b7aee3242ea9e4 SHA1: 8f9a97ef3388bc21367f245715d1e930c7dd81c0 SHA256: 0613e465dc0473c210c6e905ce938eaf6adcea800b116d0651f22c782ffb1cdb OCID: 1663401483 Original Filename: Virus.Win32.Bolzano.3628
This virus can be executed in windows NT. So I created vm for windows NT 4.0 SP6. And loaded virus in Ollydbg 1.10. I directly executed executable there. After few seconds virus terminated with exit code 5B. Does this means that when I executed virus , it is decrpyted by decryption routine and executed ? What are ways I can find decryption routine in that virus so that I can understand the exact position of decrypted virus. If I understood that I can put break point after decryption routine and recover the pair.