IDA Memory Snapshot - Amadey Malware Unpacking & Initterm Poisoning

This video was recorded only for educational purposes.
In this video, I will explain how the feature of IDA - Memory Snapshot works, what are the currently available options and the benefits of using them.
We will use the IDA Memory Snapshotting on a practical example of unpacking Amadey Malware with all shellcode pre-stages.
In the last section, I will cover what _Initterm C++ internal function is, how it is used in the Amadey sample, and how malware can abuse that to run code before reaching the "main" method. In some cases (where we hijack the execution flow), we can refer to this technique as an _Initterm function table poisoning.
Useful Links:
Amadey Malware Family: malpedia.caad....
Blog about Amadey's analysis, mentioned in the video: embee-research...
Used Amadey Sample: bazaar.abuse.c...
IDA Memory Snapshot:
hex-rays.com/p...
hex-rays.com/p...
hex-rays.com/p...