Getting gooey with GULOADER: deobfuscating the downloader

Elastic Security Labs presents a technical analysis of GULOADER (CloudEyE), an evasive shellcode downloader delivered via NSIS that embeds encrypted shellcode and uses callback-based execution and an enhanced Vectored Exception Handler (VEH) — including privileged/illegal-instruction exceptions — to corrupt control flow and thwart analysis; the report explains techniques to find the real shellcode entrypoint (using Miasm and x64dbg), how VEH modifies EIP via a CONTEXT-based XOR/offset algorithm, and offers a methodology and tools (TinyTracer, IDAPython patching, YARA rules) plus IOCs (sample SHA-256, C2 IP/URL) to detect and clean the control flow.