Reverse Engineering Invoice-2167.vhdx | DLL Sideloading & Payload Decryption Part 1

[BLUF] Analysis of a zero-detection VHDX file reveals a DLL side-loading attack where the signed legitimate executable SumatraPDF.exe loads a malicious uxtheme.dll to evade antivirus detection 0:30.

Key Takeaways:
• The malware is distributed via an ISO/VHDX image containing "invoice.pdf.exe," a masqueraded executable that relies on the legitimate Sumatra PDF signature to bypass static analysis 3:42.
• The attacker utilizes DLL side-loading by placing a malicious uxtheme.dll in the same directory as the legitimate binary, exploiting Windows' library search order 6:42.
• The campaign targets Southeast Asia, specifically Vietnam and Korea, indicating a regional threat actor leveraging social engineering via fake invoices 9:02.
• The malicious DLL dynamically resolves APIs using a custom hash algorithm to avoid static signature detection and hide its functionality from analysts 27:33.
• Inside the DLL, a file named "A" is decrypted using a 6-byte XOR key, revealing shellcode that likely executes further malicious payloads 46:52.

This technique highlights how attackers leverage trusted software signatures and dynamic API resolution to deliver malicious code, making detection difficult without deep behavioral analysis.

Sources:

• 0:30 Introduction of the zero-detection VHDX file.
• 3:42 Identification of the disguised executable payload.
• 6:42 Explanation of the DLL side-loading mechanism.
• 9:02 Analysis of the campaign's geog