Unpacking a program which seems to be not packed?

Question

I have downloaded a sample of a malware to analyze it. First, I opened it with PEiD to look if it is packed. PEiD gives me the following information:

   Microsoft Visual Basic 5.0/6.0

So, I assumed that it is not packed. When I opened it using ollydbg shows me the following lines:

   PUSH malware.00401F8C
   CALL <JMP.&MSVBVM60.#100>
   ADD BYTE PTR DS:[EAX],AL
   ADD BYTE PTR DS:[EAX],AL
   ADD BYTE PTR DS:[EAX],AL
   ADD BYTE PTR DS:[EAX],AL
   ADD BYTE PTR DS:[EAX],AL
   INC EAX
   ADD BYTE PTR DS:[EAX],AL
   ADD BYTE PTR DS:[EAX],AL
   ADD BYTE PTR DS:[EAX],AL
   DB 00
   DB 1D
   ....
   ....

So, normally it should start with a function prologue(the typical beginning line with PUSH EBP and so on) but although it is not packed, obviously the program tries to make the analyzing process harder (for me). When I step to the second line( CALL <...>), then the process begins to run and does not stop. In my previous cases, I have only unpacked malware samples that were packed with UPX. So, a piece of code like that above is completely new for me. So:

How should I solve this? Can someone give me an advice how I can handle that?

best regards,

Answer 1

Your program is not packed, but rather compiled as Visual Basic P-code or Visual Basic native code.

If it's VB native code, you can use your favorite debugger (OllyDbg, IDA, etc.) to debug it, and IDA to disassemble it.

If it's VB P-code, you can use VB Decompiler Pro to disassemble/decompile it:

... and WKTVBDE to debug it:

Note that VB Decompiler Pro is useful even for statically analyzing VB native code.