I'd be interested to know which steps of the packaging process were done automatically. Presumably these two could be automated in a straightforward fashion:

I'd be interested to know which steps of the packaging process were done automatically. Presumably these two could be automated in a straightforward fashion: Embedding a script in a command via cmd /C ... & ... & ... (twice) Generating a script and then running it (four times) The call to isDebuggerPresent in the final payload executable would be about zero inconvenience to a malware analyst. The sophistication of the packing makes me think there are probably other antidebug techniques present.