Live Stream VOD: Removing Control Flow Obfuscation From Pandora Ransomware Part 2 (Patreon)

In this Twitch stream we continue building our script to remove control flow obfuscation from Pandora Ransomware. The obfuscation is a type of control flow flattening with additional opaque predicates. We are using a combination of IDA scripts and emulation with dumpulator to reconstruct the original control flow.

Sample: 5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b

Research notes are available with code and more obfuscation learning resources: Pandora Ransomware