Welcome back.
In this lesson, we are going to dump the newly discovered and back.
So to do that, we can use a plug in Koskela.
So let's click on Plug In Scrilla and then here it is already identify the origin and entry point.
And then on all we need to do is click on EITE Order search in here.
Yes.
And he has found the high table click.
OK, so it is a table containing all the inputs for all the functions.
We need debt so that the program can run normally.
So now we click on getting parts and then he will go and fetch all the inputs in our use.
By the way, by the way.
So now we are going to dummy.
So just click on Dume.
And then give it a new location, the location is simply random, let's if anything, we need to do
is fixed and done so that you fix the icky table in a dummy.
So he based on what he has discovered.
So click on.
This dam and the dam failure, he will reopen it and fix it and give it a new name with a new extension,
he.
So if you don't, you have completed the dumping of the newly discovered and backfill.
Now we can go and open the file, analyze in daedra, so get back to go back to Ghidorah and then here
we are going to add a new lead file to Alicia.
This one with the exchange and see why, so he doesn't drag it into Hedra and it is correctly identified,
it has a be executable Angélique.
Now, he says imported click on Hawkey.
And now we can analyze it.
We will either drag it to the browser or we can just use the or the open browser and click on file open
and select newly important file click OK.
And ask you to confirm, to analyze, click on, yes.
And they here make sure that you can buy the permit I.D. check.
Scroll down and check PDB.
Come down here and check on me, not be extended barometer's and click on Analise.
And they give me a look up on the status and progress on the bottom right corner.
This just might take a few minutes, so I'll post the video and come back when it's done, OK?
After a few minutes, he has completed the analysis.
The first thing you noticed is a lot of functions.
So it's a good sign that we have successfully.
And you will also notice if you were to do a straight analysis, there will be plenty of strings.
So string's also you will find plenty of things and name everything you see, notice notices you can
check to see if there are any look at imports here.
You find a lot of imports here.
And one of the important one is going to be to.
And you can see one of the important function appears to have turned into a snapshot.
This is used by malware to list all the running processes in your operating system.
The intention of that needs to see if you are using any kind of and any analysis to reverse engineer
or analyze this malware.
If you find that you are using analysis to see will then behave differently or refuse to run.
So we can now click on this and go to the function.
And here you received three references.
You can click each one of these in turn and found it is the current one is the one you want to go to.
So you click on the other one and you will show the function here.
And you can see this to create, to help to reduce that in action.
And then over here, process three to first string compay processor to do next.
So this is a loop process goes through every item in a process list to see whether or not it has got
some kind of end of analysis to add one or two string click on this one and you will see only on this
name here and you see in your memory, you has got these two, which is comparing.
And then if you scroll down, you will have to choose Iris in these code on further.
He will find Iris Service, another one, Wireshark and then Dumb Cat and so on.
So this is a sign that it is trying to do and and analysis, so is trying to resist any kind of attempt
to analyze it.
OK, so you can go on and do your own analysis.
We have already achieve our objective here, which is to identify some of the more advanced packing
techniques and how to go about overcoming them, as well as to Dondi and take them into separate files
for analysis so we don't definitely come to the end of the session.
Thank you for watching.