Aspack 2.12 Unpacker Download
Amancio Mccrae
I am teaching myself how to do malware analysis. While attempting to analyze a malicious file found on a USB drive it came to my attention that this malware was packed with Aspacker 2.12 (PEiD). I've never come across Aspack before, and a quick google search led me to this video: =I3QeEqC4-jE This guys says to find the ECX register to find the Original Entry Point.
Packer of ASPack 2.12 was identified by several detection tools including Exeinfo and ProtectionID. To unpack ASPack 2.12 is very simple as it uses pushad and popad to start and end its unpacking stub. All we need is one breakpoint.
ASPack is an EXE packer created to compress Win32 executable files and to protect them against non-professional reverse engineering. Online can be found multiple resources descripting how to manually unpack an aspacked file. This post describe how a packed program has been unpacked using the WinDbg tool.
For this reason, AV developers use native unpacker modules for common exepackers. This is a lot faster than running the code in an emulator, but the recognizers can be fooled, so tweaked versions of known packers will avoid native unpacking.