Unpacking Princess Locker and Fixing Corrupted PE Header (OALabs x MalwareAnalysisForHedgehogs)

How to use x64dbg and VirtualAlloc hooks to dump unpacked ransomware payloads and repair damaged PE headers.

Open Analysis Live teams up with MalwareAnalysisForHedgehogs to unpack Princess Locker ransomware. We show how to use x64dbg and hooks on VirtualAlloc to dump the unpacked payload then fix the corrupted PE header... ----- OALABS DISCORD discord.gg/6h5Bh5AMDU OALABS PATREON patreon.com/oalabs OALABS TIP JAR ko-fi.com/oalabs OALABS GITHUB github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING unpac.me/#/ ----- Many thanks to Karsten from MalwareAnalysisForHedgehogs!! Check out his channel for some awesome videos on unpacking and malware analysis! youtube.com/channel/UCVFXrUwuWxNlm6UNZtBLJ-A Packed: SHA256: dc7ab2e7ed26554a11da51a184e95b01e685b1a2f99c7fc77d54d5966530bf60 malshare.com/sample.php?action=detail&hash=93cb0053e883fb262… Unpacked: SHA256: ec3a44babff75b7022fc7373bf779cac5a4243e8e81ce0e7a3fbb72558d4fca6 malshare.com/sample.php?action=detail&hash=49dbf3e4a78e87f87… Corkami PE Poster: github.com/corkami/pics/blob/master/binary/pe101/pe101.pdf X64dbg x64dbg.com/#start PEBear github.com/hasherezade/releases/releases/tag/0.3.8 HxD hex editor mh-nexus.de/en/hxd/ Feedback, questions, and suggestions are always welcome : ) Sergei twitter.com/herrcore Sean twitter.com/seanmw As always check out our tools, tutorials, and more content over at openanalysis.net