1

I have downloaded a sample of a malware to analyze it. First, I opened it with PEiD to look if it is packed. PEiD gives me the following information:

   Microsoft Visual Basic 5.0/6.0

So, I assumed that it is not packed. When I opened it using ollydbg shows me the following lines:

   PUSH malware.00401F8C
   CALL <JMP.&MSVBVM60.#100>
   ADD BYTE PTR DS:[EAX],AL
   ADD BYTE PTR DS:[EAX],AL
   ADD BYTE PTR DS:[EAX],AL
   ADD BYTE PTR DS:[EAX],AL
   ADD BYTE PTR DS:[EAX],AL
   INC EAX
   ADD BYTE PTR DS:[EAX],AL
   ADD BYTE PTR DS:[EAX],AL
   ADD BYTE PTR DS:[EAX],AL
   DB 00
   DB 1D
   ....
   ....

So, normally it should start with a function prologue(the typical beginning line with PUSH EBP and so on) but although it is not packed, obviously the program tries to make the analyzing process harder (for me). When I step to the second line( CALL <...>), then the process begins to run and does not stop. In my previous cases, I have only unpacked malware samples that were packed with UPX. So, a piece of code like that above is completely new for me. So:

How should I solve this? Can someone give me an advice how I can handle that?

best regards,

8

Your program is not packed, but rather compiled as Visual Basic P-code or Visual Basic native code.

If it's VB native code, you can use your favorite debugger (OllyDbg, IDA, etc.) to debug it, and IDA to disassemble it.

If it's VB P-code, you can use VB Decompiler Pro to disassemble/decompile it: VB Decompiler Pro

... and WKTVBDE to debug it: enter image description here

Note that VB Decompiler Pro is useful even for statically analyzing VB native code.

  • Not necessarily P-Code. Native VB has the same kind of entrypoint. – Igor Skochinsky Oct 21 '14 at 22:32
  • Thanks, @IgorSkochinsky, you're right. I've updated my answer above. I guess it shows how long ago I had to deal with VB targets :) – Jason Geffner Oct 22 '14 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.