Find out decrypted body of Polymorphic malware

Question

I want to decrypt a polymorphic malware. In polymorphic malware there must be a decryption routine which will decrypt virus code and then execute it. I want to get this pair of encrypted code and its decrypted version and do some processing on it. For this I took this polymorphic malware from offensive computing website.

http://oc.gtisc.gatech.edu:8080/search.cgi?search=bolzano MD5: 6eb5fdc7a80cb6b551b7aee3242ea9e4 SHA1: 8f9a97ef3388bc21367f245715d1e930c7dd81c0 SHA256: 0613e465dc0473c210c6e905ce938eaf6adcea800b116d0651f22c782ffb1cdb OCID: 1663401483 Original Filename: Virus.Win32.Bolzano.3628

This virus can be executed in windows NT. So I created vm for windows NT 4.0 SP6. And loaded virus in Ollydbg 1.10. I directly executed executable there. After few seconds virus terminated with exit code 5B. Does this means that when I executed virus , it is decrpyted by decryption routine and executed ? What are ways I can find decryption routine in that virus so that I can understand the exact position of decrypted virus. If I understood that I can put break point after decryption routine and recover the pair.

Answer 1

From analysis of the following report on malwr.com, it looks like the malware has crashed on there system, which could indicate that it also has crashed at yours.

1. Regarding GetTickCount API, you should check that the call to it is done from the body of the malware and not from the pre-loading environment of console executable. If you find near GetTickCount API also APIs for parsing command line parameters, than it's a false alarm.
2. As to the finding the OEP (Original Entry Point) I'd suggest to put BP on VirtualAlloc/VirtualAllocEx - as in general, but does not have to, encrypted malware will need extra space to decrypt itself. In that particular case I saw the usage of NtCreateSection which you also should monitor.
   1. After loading the malware in Debugger, try to search for dynamic control transfer, like jumps/calls to value stored in register/de-referenced memory.
   2. Also put BPs on APIs responsible for memory de-allocation (VirtualFree) so you could dump the buffer before its gone.

And for the end, do not immediately rush to a debugger, try to run the malware and look what it does by using ProcMon for example.

UPDATE:
Advise before you dive into dealing with real malware:

1. Write very simple program.
2. Download UPX compressor - its open source, as there are a lot of malwares that use it too :)
3. Compress your program with UPX
4. Now, try manually decompress your program from the compressed one.

Have fun!