Search Results

Generally, solution is to properly understand what the malware does instead of just breakpointing VirtualAlloc and waiting for a functioning PE to be handed to you on a silver platter. This usually e …

The executable is most likely embedded inside the javascript file itself, or of any accompanying files (say, an .html file that is downloaded with the javascript). As Memo mentioned, the embedded exe …

Why is this happening in the first place? Changing image bases to a different random address each time an image is loaded is called Address Space Layout Randomization (In short, ASLR). Most modern OS …

You either incorrectly dumped the unpacked PE, or incompletely unpacked as you suggested. Using ollydbg plugins like OllyDumpEx you can fine-tune the resulting dump. It is crucial to find the origina …

Unfortunately there's no easy answer here. Most of these tools employ different types of heuristics to determine the version used. Often times just applying binary signatures which could be inaccurat …

Because the malware intentionally ruins the IAT in some way or another, only keeping a small set of mandatory functions in it, leaving the work of resolving most of the APIs as part of the unpacking code …

TL;DR: What we have here is probably not an encryption algorithm, it is more likely a decompression loop, by the look of it. It simply does not do anything that could be considered even remotely simil …