[rever_ser]

i have the malware that unclear for me that is packed or not?

the program like PEid shows that code writen with c++ but in addition sandbox shows that's packed with Armadilo and in string of malware there is Aspack. so how can i recognize the malware is packed or not?

note:epilog of file is push ebp - mov ebp،esp - push -1 but it hasn't getversion phrase.i think that it is a fake epilog.

[EP_X0FF]

Usually entropy is enough, even with the naked eye.

Attach your file here so everybody can look and give more suggestions.

[rever_ser]

i upload the sample of malware. here is the link
http://uplod.ir/oe8eip84v6xk/sample.bin.htm

[EP_X0FF]

i upload the sample of malware. here is the link
http://uplod.ir/oe8eip84v6xk/sample.bin.htm

Original dropper contain huge packed data block in the overlay. This is Zeus.
In attach unpacked.

[rever_ser]

woww that's incredible.
could you make video of how unpacking process and send to me as soon as possible?
do you find which packer packed this file?
thanks indeed

[EP_X0FF]

could you make video of how unpacking process and send to me as soon as possible?

Set bp on CreateProcess. This crapware uses CreateProcess for cmd.exe to stop certain Windows services. Once you are on the breakpoint, inspect dropper virtual memory for huge RWE region that contain decrypted malware body. This is trivial and generic for most malware.

do you find which packer packed this ?

One of the thousand of malware crypters I guess. You don't need to know what kind of malware packer on file to unpack it. They all are the same. Malware unpacking != legal commercial software unpacking.

[rever_ser]

how to inspect dropper virtual memory for huge RWE region?

[EP_X0FF]

how to inspect dropper virtual memory for huge RWE region?

vmmap, petools, ollydbg etc

[SomeUnusedName]

One of the thousand of malware crypters I guess. You don't need to know what kind of malware packer on file to unpack it. They all are the same. Malware unpacking != legal commercial software unpacking.

I'd like to stress that point. So many blog posts about analyzing malware XYZ spend 5 pages on random shitty packers nobody cares about, and then 2 lines about the actual malware. Don't do that, nobody cares about packers for malware and with practice you can unpack almost all of them in no time.

[rever_ser]

excuse me sir!
can you guide me what are the base knowledge about unpacking that I should be learn ?
because as I said I am junior in malware analysis. I want to know Which kind of practices should I do ?
I am very interesting to become an expert malware Unpacker.
thanks for your attention.