Okay, After jumping to s-E-X, we come to this location and here is where the part of the unpack code
resides.
So if you look down here at the bottom, there is another anomaly.
Another anomaly where it pushes an address before return.
Normally you should pop, not push.
So this highly suspicious thing could mean that this probably is the another unpack code.
So we can put a breakpoint here and F2 and run to it.
And now if we follow this in the endgame, the content of this address, and you will see down here
that this is a newly allocated memory from a previous call to Virtualalloc.
So now it's going to push.
It's going to move this to.
So let's remove the breakpoint first F step over F8.
So it's moved to edX and now the F8 is going to push this to the stack.
And then now when it returns, it's going to return to this address instead of the normal return to
the previous function.
So let's press F8 to go there.
So we are now inside the newly unpacked section of the memory.
So let us now step through this and take a look at the various calls inside it, starting with this
first one.
So once you come here, you press f7 step into this and see what's inside.
Okay.
It doesn't do much.
Just goes to the return here.
So let's put the breakpoint over there and go straight to the return press F2 to remove breakpoint,
step over to return.
So we are now here, continue to F8 and it seems that it is going in a loop over and over again.
So we can step our loop by putting a breakpoint over here, pushing the F2 and then run to it to step
out of the loop.
And then remove the breakpoint.
Basically, we are trying to see what this unpacked code is trying to do.
Most likely, it's unpacking an executable file into memory.
And you want to dump that exe file.
So let's analyze all the calls below this.
See which part of it it actually impacts the into memory.
So let's now step over F8 and let's go inside this F7.
And you can see it is using stacked strings.
So this is an abnormal way of using the stack instead of pushing.
It is moving the various string directly into the stack using the move.
So another common way of malware authors in order to obfuscate the code, what it's doing is actually
pushing all this to the stack and using all this as a parameter for the call here.
So this call is actually making use of all this thing which is indirectly pushed to the stack.
And you can see that the library is trying to to run is actually load library kernel32.
So this is the parameter for this call.
So let's go straight away to the return.
We know what it's trying to do here.
Go straight to the return over here.
Put a breakpoint here.
F2.
Run through it.
Remove the breakpoint, press F2 again and then f8 to step to the return and then hit F8 again to return
to the main function.
So we just came out from this call here.
So this next function, let's instead of stepping into it, we can actually double click to see what's
inside.
And it looks like it's doing the same thing, the same trick using stack strings.
And we know what the purpose of is just getting the library's addresses to run and we don't want not
interested in this.
So we press the minus key to step out of the call.
We didn't actually go in.
We just inspect it.
So we skip through this call by pressing F8, step over it.
So just press F8, keep going down.
So.
Without stepping into this call, we can double click to see what's inside.
All right.
It's the same trick.
So we're now interested in this plus minus, continue to step over F8.
And it is calling this a few times.
See here, here and here, the same call.
So we can just ignore them by stepping over them.
Until we come to something different.
Okay.
We are not here again.
We do the same trick.
Instead of stepping into it, we double click to see what's inside.
All right.
Again, here, there are no calls here of any interest.
We just click minus press on, minus on the keyboard to go back and press F8 to continue to step over
it.
And then for this one, we do the same trick.
All right.
We do this.
Nothing much as well.
So we minus two step out again and it looks like this is the last function call after this.
So.
So this is the last one here.
Let's step over until we reach there.
F8.
Let's press F8.
So being the last function call is important, so we need to step into it.
So we just press this one step into or f7 the shortcut key to step into it.
And here, interestingly enough, you will see down here.
There is a push each year.
And that's a idea here.
And let's push 40 here.
So this looks like probably the parameters for virtual ALLOC.
And if you look at virtual ALLOC, this 40 is a meaningful constant.
That's why it gives the impression that it's a virtual lock.
Four parameters for virtual lock.
The fourth one is protect.
And if you go to the explanation for virtual protect and for the protect, here it is.
And analyze and look up the memory protection constants.
Scroll down.
You will see 44 040 means to set the memory location as read, write and executable rw x.
So that's why this 40 is such a give away.
When you see push 40, that means most probably this is a virtual lock here.
This is the fourth parameter.
Four, three, two, one four parameters.
So this should be a virtual lock.
And we know that virtual lock is always called during unpacking in order to set the permission for the
memory region to make it executable after the malware has unpacked code into those memory regions.
And we can confirm that now by stepping until we reach that line.
So let's continue to press F8 until we reach this call to.
And you can see it is along just as suspected.
And the fourth parameter, one, two, three, four.
Fourth parameter is to set that memory region as a read, write and execute.
If you refer back to the documentation for virtual Alloc, the return value of a virtual ALLOC is the
base address of the allocated region of pages.
Right?
So that is what virtual alloc returns.
So all functions return the result in X.
So let's step over this and we should see the return address here, the address of the new allocated
memory region.
So let's step over it by pressing F8 and this is your newly allocated region so we can go there right
click and follow in.
Done.
And here it is about to unpack something there.
So we can just step, continue to step and I have just continue to, after this call to Virtualalloc,
I continue to step, step, step, step.
And then after this call here, it has copied out the magic byte M, Z and a P header as well.
Over here.
It is also the the sentence.
This program cannot be run in Dos mode, so it seems like it is copying out the an exe file into the
newly allocated region of memory.
So let's continue to step over and allow it to finish copying.
You can see it is copying out the text section, keep on stepping over.
So all this is merely copying out bytes into this allocated region of memory.
So let's continue to step over.
Continue to step f8 and let it do its thing.
Now it's now it's copying out the data section.
Let's continue this step.
This might take a while.
And here is copying out the data section to memory.
Okay, let's press.
I'm just pressing F8 to let it do its thing to copy.
Now the reload session.
Copy it up.
And you can go on like this until you finish copying out everything.
And if you see a return.
Once you see a return, that means he has finished copying out everything, unpacking to memory.
And there you go.
So by the time he finishes this call, you will have copied everything out to memory.
So let us now step over this f eight.
Okay.
We will just finish unpacking.
Let's continue.
We can see the thing has been unpacked here.
Let's continue to see what happens next.
And let's return.
Okay.
I think it finished unpacking is more probably now we can dump this if you wanted to.
So that's all for this video.
I will see you in the next lesson.
Thank you for watching.