Unpacking Pohernah
Pohernah is a packer with Russian origins. Manual tracing is extremely tiresome since there are dozens of various decryption loops and layers in the code.
Here’s a screenshot of the GUI:
Pohernah is a polymorphic packer. Here are two screenshots. The payload file is the same, and you can see how the loader changes each time.
Entrypoint 1:
Entrypoint 2:
So, how to unpack this baby? It’s quite easy. Open the file in any hex editor, and scroll all the way to the bottom. Most likely you just see a big bunch of nulls there. Start scrolling upwards slowly, until you see something like this:
In the above picture, the DWORD at offset A176h (00401720) is the original entrypoint. Load the binary up in a debugger, set a hardware breakpoint at the address you just found (00401720 in my example), and press F9 to run to it. Then just dump and you’re ready to begin analysis.