Sample
- SHA256
-
9c692a0bf6d9d784e705dbd5f8fe8089d31eeab6fe196f9288573fd4aa3c5fa6 - Difficulty
- medium
- Platform
- Windows
- Tags
- loader packed process injection string deobfuscation
- Likes
- 1
- Views
- 54
- Submitter
- 0xca5ade19a931
Analysis
Goal
Extract the payload and describe how it is executed. List the different evasion techniques that are implemented. What encryption and hashing algorithms do you encounter?
Description
The sample is loader that decrypts an embedded payload and executes it. API functions are resolved dynamically, either through API hashing (determine the algorithm) or by name, where the names are decrypted (determine the corresponding cipher). Determine the evasion method that is used to perform low-level function calls.
Recommended Tools
binaryninja ghidra x64dbg
-
55
Comments
Please login to view and post comments.