The infamous worm, Conficker, which surfaces in 21 November 2009 and is set to time-bomb on 1 April 2009, was literally over the media. Although studying its malware source code is the best way to fully understanding its features and impacts, unfortunately getting the source code to study sometimes are impossible. There is still has alternate way, which is through reverse engineering of the binary file. A lot of malware writers use packer to pack the malware either the packer is written by them or downloaded from internet. During the analysis of Conficker worm, MyCERT found that the worm has been compressed by a custom “run-time packer”. This section will focus on the techniques of automated unpacking Conficker worm variant B.

Useful tools: