Jumping to the Main function it calls sub_403B3A which has a anti-debugger check. Looking at calls to this function, there are references to various AutoIT strings. Looking at the parent function it opens a file passed as an argument. Looking at the call graph shows this is a leaf node for the call graph, which can potentially mean that execution will continue outside of the scope of this application or all the information for this chain of calls was acquired. This function will load the resource make some calls and load the resource data within. Seeing the large resource immediately leads me to look for resource related calls such as LockResource, SizeOfResource, LoadResource etc.ДЇindResource is only called within this function so if we assume that the AutoIT script is part of the malware, this function becomes increasingly important. Immediately the AutoIT caught my eye as that's not something I have dealt with before.Д®ven more suspicious is that its almost 53% of the file, and a maximum entropy value of 8. You can also see that there is an embedded resource within the application. So there is definitely some encrypted or compressed content here. Technical AnalysisДЇirst step as usual, is opening the sample in PE studio for a quick triage.ДЇrom the output here you can see its a Cpp application with a rather high entropy of 7.5. The sample can be found here if you wish to follow along. Since I generally focus on targeted malware, I knew this was going to be a good change of pace. Nanocore has been around for many years and is one of the simpler and cheaper malware familieis out there but I never had the availability during work to look at it.

I ended up picking a Nanocore sample to analyze. So I went to any.runs malware trends page, and randomly picked a sample. I will officially be working as a security researcher and in preparation of that I felt that I needed to keep my reverse engineering skills sharp.

There's been some changes in my life that have distracted me from my malware temporarily. Hello everyone! Its been a while since I've posted.

Ghost crypter