Inside the Decryption Routine Invoice 2167 vhdx | Debugging Malware with x64dbg Part 2
Source: YouTube · Malware Research Diary · published Jul 29, 2026 · 31:18
This video details the dynamic analysis of a side-loaded malware DLL, demonstrating how to bypass thread creation in x64dbg to trace a custom six-byte sorting decryption routine and resolve hashed APIs to extract the final shellcode.
Key Takeaways:
• The malware utilizes side-loading by executing a malicious DLL alongside a signed legitimate executable 0:20.
• A custom six-byte sorting algorithm is applied to an encrypted buffer to decrypt the shellcode payload 1:51.
• The analyst modifies execution flow in x64dbg to bypass thread creation and directly trace the decryption logic 7:26.
• Dynamic API resolution identifies key functions like CreateFile, GetFileSize, and VirtualAlloc used for memory allocation 9:01.
• Successful decryption is confirmed by the appearance of "explorer.exe" strings in the memory buffer 2:12.
• The decrypted shellcode is dumped for further analysis, revealing potential secondary unpacking routines 25:12.
Dynamic debugging is critical for uncovering obfuscated malware behaviors that static analysis cannot reveal, emphasizing the need to track memory changes and API calls to understand the full execution path.
Sources:
- 0:20 Introduction to the malware file structure and side-loading.
- 1:51 Explanation of the custom decryption sorting algorithm.
- 7:26 Modifying code in x64dbg to bypass thread creation.
- 9:01 Resolving API hashes to identify file and memory functions.
- [2:12](https://www.youtube.com/w
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello. Welcome back for the part two in analyzing this um malware. So, um for recap, um we open up the file. This this file right here, which is um it's a virtual um um drive. Um once we open it, we um found variety different files within it. Um the first one invoices the uh legit software uh um that's have signature signed to it. And we also analyzing this malicious um DLL using the um side loading, right? And they open up this file right here, which is the decrypted um encrypted file, likely it's a cell. So, when we went through the decryption um in here, so they're sorting. Once they load up the file, um Where is it? Once they open up file, they would then um right here. So, they'll open up the file, create file, then read the file, um get the file size right here. Um then this is uh um…