Join us for a deep dive into this interesting malware that was used to drop Emotet. We will reverse engineer the loader and provide a tips and tricks for IDA Pro along the way! ----- OALABS DISCORD https://discord.gg/6h5Bh5AMDU OALABS PATREON https://www.patreon.com/oalabs OALABS TIP JAR https://ko-fi.com/oalabs OALABS GITHUB https://github.com/OALabs UNPACME - AUTOMATED MALWARE UNPACKING https://www.unpac.me/#/ ----- Automated Malware Unpacking https://www.unpac.me/ Any-Run Sandbox Run of Malicious Document https://any.run/report/dc40e48d2eb0e57cd16b1792bdccc185440f632783c7bcc87c955e1d4e88fc95/580aa295-111c-4123-957a-ed6c325b0b7f Loader Sample Free Download from Malshare fb07f875dc45e6045735513e75a83c50c78154851bd23a645d43ea853e6800ac https://malshare.com/sample.php?action=detail&hash=706ea7f029e6bc4dbf845db3366f9a0e PrnLoader decryption script (python) https://gist.github.com/herrcore/dcbffcdf544b38d87d182c940c5ab24d Feedback, questions, and suggestions are always welcome : ) Sergei https://twitter.com/herrcore Sean https://twitter.com/seanmw As always check out our tools, tutorials, and more content over at https://www.openanalysis.net/ #MalwareAnalysis #IDAPro #PrnLoader