Manual Unpacking IcedID Write-up

Tools:

PE files static analysis: PortExAnalyzer; PE-bear

Debugger & plugin: x64dbg + ScyllaHide Anti-Anti-Debug

Aplib decompress: aplib-ripper

1. Static Analysis

Thow the sample to PortEx Analyzer, tool will analyse file with a special focus on malformation. We get the results:

The section .text has high entropy, so may be the sample is packed:

This sample is PE32 with ASLR enabled (can quickly disable this feature by using setdllcharacteristics):

This sample reveals information about the pdb path:

Some anomali…