Hi everyone! Happy New Year and Merry Christmass to All researchers and reverse engineers!
today i have caught virus from one of warez sites and have decided to research its file - boot.com (actually it's usual .exe, size about 30 kb). i can't understand what packer of this. PEiD can't detect packer too.
Some code from EP:

data:00401EC4 start proc near
data:00401EC4 xor edx, eax
data:00401EC6 jmp loc_401415
data:00401EC6 start endp

data:00401415 loc_401415: ; CODE XREF: start+2j
data:00401415 xor eax, eax
data:00401417 call sub_4010FB
data:00401417 sub_401400 endp ; sp-analysis failed

data:004010FB sub_4010FB proc near ; CODE XREF: sub_401400+17p
data:004010FB mov ecx, ecx
data:004010FD add esp, 4
data:00401100 sub eax, 0FFFFFFFFh
data:00401103 call sub_40171E
data:00401103 sub_4010FB endp ; sp-analysis failed

data:0040171E sub_40171E proc near ; CODE XREF: sub_4010FB+8p
data:0040171E mov ecx, ecx
data:00401720 add esp, 4
data:00401723
data:00401723 loc_401723: ; CODE XREF: sub_401BCF+18j
data:00401723 push 0A7E2DCE3h
data:00401728 mov [esp+0], eax
data:0040172B ror dword ptr [esp+0], 0Ch
data:0040172F and dword ptr [esp+0], 0F00000h
data:00401736 rol dword ptr [esp+0], 0Ch
data:0040173A mov eax, [esp+0]
data:0040173D mov ecx, ecx
data:0040173F add esp, 4
data:00401742 call sub_4018D9
data:00401742 sub_40171E endp ; sp-analysis failed

Attached boot.zip with password - "damnmalware" include boot.com
Thank to everybody!

It extracts 3 files,2 tmp files trojan and autorun info
Copy bootmalware into resycle folder(if I spelt it right heh)
It starts spoolsv,it sucks up your memory and freeze your windoze.

Nothing interesting in this malware....

packed private cryptor, PEID identify only public packers.

malwares are packed with custom packers, which are called as "trcrypt"

A1AD might be the oep,I might be wrong
since it doesn't runs at all LOL

this is TDSSL group malware with SYS file + dll insideSYS, i many time unpacked..

& this tr/packer probably uses VM-ised_loader code.., but easy for tracing using TRACE_OVER on calls : )

Hey evaluator,

Thanks for clearing up the mess I'm in
I thought the oep is some where beyond that

l8r

since this thread is already open i'd like to ask what packer creates sections like rdata, fdata, cdata, pdata..?

could be any packer , but wild guess...armadillo ?

that was first thought that came to my mind too but i wanted to be sure. oh well, i failed to notice VirtualizerSDK64.dll in same dir. looks like its virtualizer.... not too good