How do I calculate the location of the string in this sample located at offset 0x1CAD8?
The instruction at 0x140001A97 in the sample is:
0x140001A97 F2 0F1005 39C60100 movsd xmm0, qword [rip + str..exe]
The opcode has 0x39C60100 which is 0x1C639. If I add that to rip, I don't land on the address of the string:
0x140001A97 -> offset = 0xE97
0xE97 + 0x8 + 0x1C639 = 0x1D4D8
The string's offset is 0x1CAD8 not 0x1D4D8
What am I missing?
The sample is Ryuk:
18faf22d7b96bfdb5fd806d4fe6fd9124b665b571d89cb53975bc3e23dd75ff1
If you need a copy of the sample, a base64 encoded passworded zip archive with the sample is located here:
https://pastebin.com/aKskMXY7
The password for that zip file is reseinfected. If you need something to decode base64 quickly, use this cyberchef recipe:
From_Base64('A-Za-z0-9+/=',true)