Welcome back.
In the previous video, we have dumped this dump file from the using process hacker because it was a
self-injecting Trojan.
So we open flair now and we are going to use pebbair to unmap this file.
So let's go to utilities and open pebbair.
Then we can now drag this into VBA.
And then if you take a look at the imports, it is all screwed up because of the of the section headers,
which is not aligned properly.
It has not been unmapped yet.
So we need to unmap it.
Go to session headers.
First step is to change all the raw address to become the same as the virtual address.
So this first one will become 1000.
This one will become 22,000.
This one will become 20,000 and this one will become 29,000.
Rate once you have done that.
Next thing is to calculate the raw size based on the on the raw address.
So for the first one is 22,000 -1000, that gives us 21,000.
This one is 28,000, -22,000.
So it is 6000, which is already correct.
This one should be 29,000 -28,000.
So that gives you 1000.
Okay.
So that's done.
And then now over here for this, if we wanted to, we can fix it so that it fills up the entire block
here so we can change this to 8000, for example.
Not enough.
So maybe 9000 not enough.
So maybe a
nine, maybe B,
almost C, Yes.
So it's filled up.
So the virtual size, we can leave it not necessary.
And then now we can go and check the imports.
And we see that imports are now okay.
That means we have correctly unmapped it.
Next thing is to fix the base address.
So that is called rebasing.
So click optional header and look for the image base.
So the image base needs to be the address where we dump this from, which is one followed by seven zeros.
As you recall.
So it's one followed by seven zeros.
Hit.
Enter.
Okay, that's it.
Now we can check the exports and you can see the name is loaded, the Eldrick, which is the name for
the loader for tracks and imports, has been fixed.
Okay, so now we can dump this.
Right click on this name here and save the executable as.
And we can now call it dump unmap and click save.
Okay.
And now you can test it with either by opening, either
click new and then select the new unmapped region.
The new unmapped one.
Click open.
Click.
Okay.
He is no more error.
That means it has probably been unmapped.
And now you can go ahead and you can see so many functions.
Inputs are there as well.
Open Subviews.
Look at strings.
And you also have strings, although it's encrypted.
We have had the objectives of this session.
We have successfully unmapped dridex.
Thank you for watching.