Reverse Engineering GuLoader | NSIS, VEH Control Flow & Shellcode Decryption Part 1

[BLUF] This video demonstrates the dynamic analysis of a sophisticated Inno Setup-packed malware dropper, highlighting techniques to bypass anti-debugging measures and extract shellcode using x64dbg. 0:05

Key Takeaways:
• The malware sample is an Inno Setup installer used as a sophisticated loader, detected by 52 AV engines as a generic GooLoader 2:27.
• Standard extraction tools like recent 7-Zip versions fail to reveal the internal script; analysts must use older versions (e.g., 15.05) to extract the NSIS script 6:30.
• The NSIS script configures the malware to drop files into hidden directories and establish persistence via the Windows Startup folder 9:09.
• Dynamic debugging with x64dbg is essential to trace the execution flow, as static analysis is hindered by complex control flow obfuscation 11:50.
• The malware employs anti-debugging techniques such as IsDebuggerPresent and int 3 instructions to detect and evade analysis environments 45:55.
• Analysts can dump the shellcode from memory by identifying the executable region in the memory map and saving it for further static analysis 26:14.

Closing Statement:
Effective reverse engineering of packed malware requires a combination of static script analysis and dynamic debugging to bypass obfuscation and extract the final payload for deeper investigation.

Sources:

• 0:05 Introduction to the malware hunting research diary and the subject sample.
• 2:27 Classification of the malware as a generic GooLoader with high AV detection.