Hello and welcome back in this session.
We are going to use media to try to investigate how this thing is being backed and then get some idea
on how to unpack.
So go ahead and launch your Ghidorah.
Harris created a new project.
Noninsured click on next click on a tree to navigate to the desktop select folder containing the malware
and give it a name.
Call it seemed.
Click on Finish.
Next, Britney seemed way into the second half of the.
He has identified it as a B executable click on Olcay.
Check on both and Click says.
And while Kay.
Next, the second way into the courtroom browser.
He says that he has not been in the night and ask you if you would like to analyze it.
Yes.
Make sure you check on the compiler barometer, Heidi, scroll down and check PTB, scroll down and
check on Windows XP, propagate external parameters and analyze.
And then keep an eye on the bottom right corner for the status and progress of the analysis, it might
take a few minutes.
So I would just pass the video and come back and then it's 10.
Just click OK to dismiss this and now he's completed.
Now, if you take a look at the imports, you'll find very few functions which confirm our findings
earlier.
Yet because so few functions.
This is probably packed.
Now, let's go to the entry entry point.
Before that, we are going to edit our preferences to options.
For our listing fees, he wanted to close a tax highlight, left mouse click, he'll apply.
So this is the entry point.
And then if you scroll down to the return here of this function.
You will notice some abnormal returns.
A bush just before yet another one here, Bush has before it, so on.
So this is what I mean by fake returns.
So what he does is he pushed this under this tank and then he returns to this address.
So now you would jump over here and execute this and this thing again pushes to this day and then when
he returns, he returns to what is the state, which is actually this.
And again, here it pushes this to the state.
And then when he returns, he returned to DSR, which is actually over here now because of this non-standard
release of the epilogue, the listing has not been disassembled vydra.
So this is not a complete function.
So in order to try to reconstruct a function to be complete, he can tell you try to disassemble this,
but which has been left out.
So we just have a reichling this and then disassemble and assemble this for us.
The next thing we want to do is to not hold this up and then rebuilt the whole function again to incorporate
the newly disassembled region.
So to do that, we can select all this and Rackley and then.
Clearcutting.
So now you can go to the excited and open this up, so we select the windows here and select, but we
should open up the hectoliter.
And I know in order to know all this advice here at 9:00 a.m., so on, which is referring to all this,
we will click on this icon to anybody, anything.
And then you can come back down here and know I'll be and you know, I'll be there, no hexes, nine
zero nine zero means no operation.
That means we don't want anything to be executed.
And this addresses.
So we just keep on typing nine zero nine zero repeatedly.
And as you take nine zero, each one of these who reflect the change.
So we are going to insert all these nine zeros, also known as no Opsahl, no operations all the way
up to the last three.
So let's continue to do that.
And the last one, so now they know all this, we can lock in again and then now we can repair this
part of the court to adelgid, right.
To rebuild their function, to include the bottom section, which has just been disassembled.
So to do that, we just select somewhere here on top here and indirectly and select clear floor and
repair.
And the difference is backflow.
Just click on, OK?
OK, so now Ghidorah has revealed the thing, as you can see, to include this new section of the instructions,
and he will then create a new function to reflect the change.
So we can see here and there's a new function here, which now shows you the original function.
So now you can click on the last one here, return and then see if there are any more abnormal returns.
Now, if you look at the bottom here, you will see a normal push and return, so this again seems to
suggest that they are more unpacking to do so, we can trace this year four zero one one three four.
And he seem to have seen this line here that this address is push to X and register.
So it is a move to in the is pushed to the stack.
So now if you trace this back by double clicking on this.
You can go to the function and see what's happening there, and if you scroll down to the bottom.
You again see over here.
There is an abnormal Anjum.
Over here, see this, that means this race never reached, he pushes and he jumps straight to one four
one one six seven, which is here at the race.
So this is also an unexpected jump.
And why is it so easy to trace it up here?
You can select one easy and you highlight for you, and this is the address how the data is pretty easy.
So now we trace this like double click on this and you see that here it is undefined.
All right.
So nice to go back to the previous location.
So in order to know what exactly is being pushed into an X here, we need to use debugger.
That means we need to put a breakpoint somewhere here and then let the debugger run to this point.
Then we can investigate what is the value and what is actually being trying to be unpacked there and
probably will find a shortcut over there.
So we do that in the next lesson.
Thank you for watching.