Entry 003
Unpacking a custom loader without running it
Static-first analysis of a staged Windows loader — where the second stage is decrypted, how its key is derived, and what the import stubs give away.
Why static first
A sandbox tells you what the sample did once, on one machine, with one set of checks satisfied. Reading the unpacking stub tells you what it can do.
The key derivation
The decryption key is not stored. It is assembled from two constants and a value read out of the PEB, which is what makes the stage-two blob look like noise to a scanner while remaining trivially recoverable.
Resolving imports
Every API is resolved by hash at runtime. Recovering the hash function once turns the whole import table back into names.