@nicolasbrulez Don't you automate it? I know its heavily polymorphic but still a dynamic unpacker should chew trough that. SecuObs - L'observatoire de la sécurite internet - Site d'informations professionnelles francophone sur la sécurité informatique