Malware Analysis - ZPAQ to .NET downloader to Injector DLL unpacking

A phishing attempt with an unusual archive format named ZPAQ leads to an interesting malware downloader. We debloat the sample and decrypt the downloaded .wav file with binary refinery. It turns out to be an injection DLL. We use powershell to execute it and deal with its obfuscation. Although the injector fails, we unpack the payload.

Tools: zpaq, DnSpy, IlSpy, binary refinery, PortexAnalyzer, HxD, SystemInformer

Malware course: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?couponCode=CE8D957072A4B79B5EB2
ZPAQ article: https://isc.sans.edu/diary/rss/30366
ZPAQ sample: https://malshare.com/sample.php?action=detail&hash=1c33eef0d22dc54bb2a41af485070612cd4579529e31b63be2141c4be9183eb6
.WAV file: https://malshare.com/sample.php?action=detail&hash=c2c466e178b39577912c9ce989cf8a975c574d5febe15ae11a91bbb985ca8d2e

Twitter: https://twitter.com/struppigel

00:00 …

analysis archive binary deal decrypt dll file injection injector malware malware analysis obfuscation phishing powershell refinery sample unpacking wav zpaq