From LinkedIn DM to DLL Sideloading | Inside a Fake Job Interview Malware Part 1

This video analyzes a LinkedIn-targeting phishing campaign that delivers malware through a fake document review site, using DLL side-loading and a Node.js-based second stage 0:09-0:37.

Key Takeaways:
• Victims download an archive containing a legitimate Word document and a malicious DLL that exploits Windows' directory search order to perform DLL side-loading 1:43-3:34
• The DLL modifies the read-only .text section to write-execute, injecting a jump instruction (E9) to redirect execution to the malware's entry point 5:04-7:00
• The malware searches for "decoy" in its binary, extracts an embedded PDF, and displays it for 60 seconds as a distraction 13:00-15:04
• A second-stage Node.js executable embedded in the archive contains WebAssembly and HTTP libraries indicating C2 capabilities 21:16-42:53
• The payload uses a modified Sea packer that hides JavaScript in a non-standard location, evading standard extraction tools 47:05-1:06:21

The analysis is ongoing, with plans to locate and extract the hidden JavaScript payload from the modified Sea packer.

Sources:

• 0:09-0:37 Campaign overview and delivery
• 1:43-3:34 DLL side-loading technique
• 5:04-7:00 Shellcode injection via .text modification
• 13:00-15:04 Decoy PDF extraction and display
• 21:16-42:53 Second-stage Node.js payload
• 47:05-1:06:21 Modified Sea packer analysis