Automated Unpacking: Dynamic Extraction of Obfuscated Payloads with mal_unpack

Tool: https://github.com/hasherezade/mal_unpack

Executive Summary

The sample is position-independent shellcode (PIC) for 32-bit Windows. It implements runtime API resolution by hash, decompression of an embedded payload, CPUID-based environment checks, and thread-based execution with a state machine. No import table is present; the only static string is KERNEL32.dll, indicating manual resolution of Windows APIs from kernel32. The code is consistent with loader/dropper or first-stage shellcode commonly seen in exploit payloads, packed malware, or modular implants.

File Properties

PE Sections

Observations

IAT

Description

The Import Address Table (IAT) is a key structure in PE files that lists the external functions the program needs to run.

Automated unpacking using malunpack

Figure: Fig 1 - Unpacking using mal_unpack Click to zoom ↗

Fig 1 - Unpacking using mal_unpack

This tool unpacked the sample and put it in mount.exe.out directory.

Figure: Fig 2 - Output dir Click to zoom ↗

Fig 2 - Output dir

There’s a lot of files we’ll be focusing on .shc shellcode file.

Binary Ninja Analysis

Open the shellcode file in binary ninja. Choose appropriate platform windows-x86

Figure: Fig 3 - Opening shellcode in binary ninja Click to zoom ↗

Fig 3 - Opening shellcode in binary ninja

Figure: Fig 4 - binary ninja Triage summary Click to zoom ↗

Fig 4 - binary ninja Triage summary

Switch to linear for high level representation.

Figure: Fig 5 - Linear View of binary ninja Click to zoom ↗

Fig 5 - Linear View of binary ninja

The sample utilizes a custom implementation of dynamic API resolution to hide its true capabilities from static analysis tools and the Import Address Table (IAT).

Mechanism: PEB Traversing & ROR13 Hashing

Instead of calling Windows APIs directly, the malware manually locates the Process Environment Block (PEB) via the Thread Environment Block (TEB) at fs:[30h]. It then iterates through the InLoadOrderModuleList to find loaded system DLLs (typically kernel32.dll or ntdll.dll).

Once a DLL is located, the malware parses the PE Export Directory to find function names.

Figure: Fig 6 - Function **`sub_467(0x726774c)`** Click to zoom ↗

Fig 6 - Function sub_467(0x726774c)

Shellcode Information

Technical Analysis

Memory layout

Anti-Analysis & Evasion

API Resolution (PEB-based)

The shellcode utilizes a multi-step process to interact with the Windows OS without static linked dependencies:

Execution flow

shellcode_entry (0xB78D)
  ├── Resolve kernel32 (PEB)
  ├── Get system directory / build path
  ├── CreateThread(..., FUN_0000A524, ...)
  └── FUN_0000A524 (message/wait loop)
        └── Wait → FUN_0000A465 (state machine)
              State 0: FUN_00005C69, FUN_00006B55, FUN_0000C04A (init, resolve APIs, create thread)
              State 1: FUN_00007EF1 … FUN_00009A2F, FUN_00005A04 (setup)
              State 2: FUN_0000A358 (main logic)
                    ├── GetTickCount, timing
                    ├── FUN_0000A5D7
                    ├── FUN_00005A43 (decompression)
                    │     └── Inflate (zlib-style) → decompressed payload
                    ├── FUN_00005BD6 / FUN_0000C0FC / FUN_0000A679 (payload execution path)
                    └── Optional: FUN_0000C384, FUN_0000C0B7, FUN_0000C45D
              State 3: Cleanup (e.g. close handle)

Payload Handling

Execution Logic: Routine FUN_00005A43 initializes the inflate pipeline. The resulting decompressed data is then passed to FUN_0000A679, which likely handles the execution of the next-stage binary or the parsing of a decrypted configuration file.

Environment & Capability Detection

The sample performs deep hardware inspection to ensure it is running on a specific target environment and to avoid detection by security researchers using generic virtual machines.

Inferred Windows API Usage

Since the malware uses dynamic resolution via ROR13 hashing, the following APIs are inferred based on the operational context of the code and observed memory constants:

Behavioral Summary

The following table summarizes the execution lifecycle of the shellcode from initial entry to final payload delivery.

Indicators of Compromise (IOCs)

Static Indicators

Capabilities Assessment

This assessment provides a high-level overview of the functions currently integrated into the analyzed shellcode.