Hello and welcome back.
In this video lesson, we are going to compile the source code into an executable binary.
So let's open terminal xixi for native tools command prompt and copy this for the location.
Right click copy.
And you will never get to see the space.
Right click, paste and enter.
So let us now build our encrypted chocolate.
So we're going to use the Python script and we need to supply the path for your python.
Two point seven for me using C backslash by 20 points.
Forward slash python supply the name of the script we choose.
And create start by supplying the input file, which is your notepad tembin.
Schuckert.
And then redirect to the output, which you call better.
Yes.
Oh, he did enter.
And here you find a new, far better he is less Reichling and open.
He's not back plus plus.
And you will see that to erase the key and the bill.
So the copy key.
Right click, copy open your source could be packed last place and base your key over here.
Next, we will copy the encrypted data.
And P.S., over here.
That's cruel to the right to see he got everything.
Yes, everything seems to be in order, so we can now, Bill, how far we were to save it first.
Now we'll call decompile Bachhan and hit enter.
And you will see this in New Jersey, Father, which is our newly compiled newly built malware, so
let us not analyze his ex tbg.
We run our econ.
He didn't again, he enter and he will launch now.
OK, now we hear analyze, he asks TVG, so let's run now.
One more time opening for DBG.
Yes.
We should the options preferences set has before, and the only entry point is checked.
Now we'll click on file attach and attached to the aThink process.
Now we'll open symbols and double click on the async EIC on you, and then you can run to synchronize
the process your CBG.
It is now over here.
And you you'll notice he has printed the address.
So let's follow this right Caputo's.
And go to the dumb one.
Go to expression.
Right click and paste.
And you see, this is the encrypted encrypted payload and left right clicking for this in-memory net
and you will see it on the stack in nine, eight, eight, nine, eight track.
So let's convert this hex here to decimal.
And you see two, seven, one, two.
So we go to chess.
You see this to sound one, two on the stack.
So.
So that concerns confirms that how lost the steak and the reason why is this Thanksgiving, because
he's because the.
Rare is nuclear insight in the main function.
Next, we will take a look at the El-Katatney region, which you see followed by four zeros.
So we copy that.
You hate to dumb them, but to Rackley and then go to expression and then right click and paste and
click, OK?
And you see now is empty blank.
OK, now if he hit enter here, he will go in the decrypt and back into this region.
So if you follow this rightly and following a memory map, we will see that it is executable and readable,
not this private, because it is coming from the virtual Hallock, which has created this allocative
memory for our private use for the process to use.
And it is set to armed because of virtual protection over here, which of our next to hear executable
and readable.
So now he's waiting for us to hit enter.
So when you Crescenta.
The shark executes and launches that and the number hits, so that happens because creates a great threat
who roundy I look at a region which has got to unpack and decrypt that data.
So that's all for this video.
I thank you for watching.