Skip to content

WARNING: This Repository Contains Malware #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Dogface2k wants to merge 1 commit into
base: main
Choose a base branch
from
Open

WARNING: This Repository Contains Malware #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
248 changes: 144 additions & 104 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,104 +1,144 @@
### DLL Injector Cheat C++


## Compile

1. Clone the project to your computer or download it as a ZIP file.
2. Open the solution file (.sln).
3. Select **Build Solution** from the **Build** menu or press `Ctrl+Shift+B` to compile the project.

## Usage

The injection module will download PDB files for `ntdll.dll` and its wow64 version on x64 systems to resolve symbol addresses. To start the download, use the `StartDownload` function. The injector can only operate after downloads are complete. Use `GetSymbolState` and `GetImportState` to check if downloads and address resolution are finished `(returning INJ_ERROR_SUCCESS (0))`. You can track download progress with `GetDownloadProgress`. If unloading the injection module during download, use `InterruptDownload` to avoid process deadlock.


## Features


<summary>Injection Methods</summary>

- **LoadLibraryExW**
Description: Injects an external DLL file into the target process.

- **LdrLoadDll**
Description: Loads and associates a DLL file into the target process.

- **LdrpLoadDll**
Description: Manages DLL loading operations.

- **LdrpLoadDllInternal**
Description: Manages DLL loading operations as an internal function.

- **ManualMapping**
Description: Manually loads DLL code into the target process.



<summary>Shellcode Execution Methods</summary>

- **NtCreateThreadEx**
Description: Injects code by creating a new thread.

- **Thread Hijacking**
Description: Injects code by using an existing thread as the target.

- **SetWindowsHookEx**
Description: Injects code using Windows event hooks.

- **QueueUserAPC**
Description: Injects user-mode code into a thread.

- **KernelCallback**
Description: Injects code using kernel callbacks.

- **FakeVEH**
Description: Injects code by manipulating Virtual Exit Handlers.




<summary>Manual Mapping Features</summary>

- **Section Mapping**
Description: Maps DLL sections into the target process's memory.

- **Base Relocation**
Description: Places DLL code in the target process's memory appropriately.

- **Imports**
Description: Properly resolves dependent DLLs.

- **Delayed Imports**
Description: Handles dependencies in a delayed manner.

- **SEH Support**
Description: Provides Structured Exception Handler support.

- **TLS Initialization**
Description: Initializes Thread Local Storage.

- **Security Cookie Initialization**
Description: Initializes the security cookie.

- **Loader Lock**
Description: Provides synchronization using the loader lock.

- **Shift Image**
Description: Injects code by redirecting image loading.

- **Clean Data Directories**
Description: Cleans data directories, removing unnecessary information.



## Preview

![image](https://user-images.githubusercontent.com/105746452/169072886-9292af6d-f26a-42ae-b23b-282f18b19255.png)

## Disclaimer

This source code is for educational purposes only. It's created to explore reverse engineering without impacting other gamers' experiences.

## License

This project is licensed under the MIT. For more information, see the [License](LICENSE).
SECURITY ADVISORY: Supply Chain Malware Detected — DO NOT USE

WARNING: This Repository Contains Malware

This repository contains a **supply chain malware dropper** embedded in the MSBuild `.vcxproj` file. **Building this project in Debug configuration will compromise your machine.** The entire repository appears to be **bait** — a seemingly functional DLL injector designed to lure developers into compiling and executing the hidden payload.

---

What Was Found

### Location
`DLL Injector V4/DLL Injector V4.vcxproj` — Lines 112 (Debug|x64 PreBuildEvent)

### Trigger
Building the project in `Debug|x64` configuration silently executes a multi-stage payload **on the developer's machine** during compilation.

### Malware Execution Chain (4 Stages)

```
┌─────────────────────────────────────────────────────────────────┐
│ STAGE 1: MSBuild PreBuildEvent (Batch Script) │
│ Triggered when user hits "Build Solution" (Ctrl+Shift+B) │
│ │
│ • Creates: %TEMP%\z3IdPT\ │
│ • Writes: IkA3CyZgY.vbs via obfuscated echo concatenation │
│ • Spawns: cscript //nologo "%TEMP%\z3IdPT\IkA3CyZgY.vbs" │
└───────────────────────────┬─────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ STAGE 2: VBScript Decoder (IkA3CyZgY.vbs) │
│ │
│ • Uses MSXml2.DOMDocument.6.0 to decode Base64 → binary │
│ • Uses ADODB.Recordset for binary chunk handling │
│ • Writes decrypted payload to: %TEMP%\z3IdPT\PKCA.ps1 │
│ • Spawns: powershell.exe -ExecutionPolicy Bypass -File │
│ "%TEMP%\z3IdPT\PKCA.ps1" │
│ with window hidden (SW_HIDE = 0) │
└───────────────────────────┬─────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ STAGE 3: PowerShell Decryptor (PKCA.ps1) │
│ │
│ • Defines fn "wd9L7u6kgnx" (PBKDF2-SHA256 key derivation) │
│ • Creates Rfc2898DeriveBytes(password, salt, iterations) │
│ • Defines fn "ftFfhZMIpO1" (AES-CBC-256 decryption) │
│ • Creates AesManaged in CBC mode with PKCS7 padding │
│ • Creates decryptor from derived key + IV │
│ • Decrypts Base64 blob → raw bytes │
│ • Converts to string → [Array]::Reverse() to deobfuscate │
│ • Creates alias "pWN" = Invoke-Expression │
│ • Calls pWN(decrypted_reversed_string) │
└───────────────────────────┬─────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────┐
│ STAGE 4: Unknown Final Payload │
│ │
│ • Executed via Invoke-Expression on the deobfuscated string │
│ • Base64 string "SW52b2tlLVY4cHJlc3Npb24=" → "Invoke-V8pression"│
│ (intentionally misspelled to evade string scanning) │
│ • Likely: RAT, info-stealer, crypto-miner, or botnet agent │
│ • Technique consistent with: Reflective .NET Assembly Load │
└─────────────────────────────────────────────────────────────────┘
```

### Deobfuscated PowerShell Identifiers

| Obfuscated Variable | Deobfuscated Purpose |
|---------------------|---------------------|
| `$updghPRhQONPB` | AES decrypted data payload |
| `$yZhiBPRiGcccB` | AES IV |
| `$mbvHftYsefjJj` | `AesManaged.CreateDecryptor()` |
| `$mkKqjPpOucMnT` | Base64 decoded binary |
| `$funtounfdlccA` | Length offset calculation |
| `$mJijsJYeIWMcC` | `.ToCharArray()` result |
| `$TCBhHvHaeVTze` | `[System.Text.Encoding]::UTF8.GetString()` |
| `$fdedhvinigClb` | Decoded Base64 → `"Invoke-V8pression"` |
| `pWN` | Aliased to `Invoke-Expression` via `New-Alias` |

### Indicators of Compromise (IOCs)

| IOC | Value |
|-----|-------|
| Directory created | `%TEMP%\z3IdPT\` |
| VBS file dropped | `%TEMP%\z3IdPT\IkA3CyZgY.vbs` |
| PS1 file dropped | `%TEMP%\z3IdPT\PKCA.ps1` |
| Batch process spawned | `cscript.exe //nologo` |
| PowerShell process spawned | `powershell.exe -ExecutionPolicy Bypass -File` |
| COM object abused | `MSXml2.DOMDocument.6.0` |
| COM object abused | `ADODB.Recordset` |
| COM object abused | `Scripting.FileSystemObject` |
| COM object abused | `WScript.Shell` |
| .NET crypto abused | `System.Security.Cryptography.Rfc2898DeriveBytes` |
| .NET crypto abused | `System.Security.Cryptography.AesManaged` |

### Obfuscation Techniques Used

- **10 separate string variables** (`b`, `c`, `d`, `y`, `t`, `r`, `w`, `q`, `s`, `z`) each XOR'd/concatenated into the final payload
- **Arithmetic noise**: every string is wrapped in redundant bitwise operations like `((-534 -Bxor -534) -Band2*(534 -Band -534))` etc. that evaluate to 0 — padding to bloat the payload and evade signature scanning
- **Hidden PowerShell window**: `m.Run ..., 0, False` — window is hidden during execution
- **-ExecutionPolicy Bypass**: PowerShell runs with no restrictions
- **Base64 → AES-CBC-256**: dual-layer encryption requires both the key AND salt to decrypt
- **String reversal**: `[Array]::Reverse()` on the final command to break static analysis
- **Alias abuse**: `pWN` aliased to `Invoke-Expression` to hide the execution command
- **Misspelled evasion**: `"Invoke-V8pression"` instead of `"Invoke-Expression"` — evades simple string searches

---

Why This Looks Like Bait

The codebase has several hallmarks of a honeypot targeting cheating/security tool developers:

1. **Hardcoded Chinese user paths**: `C:\Users\lisongqian\source\repos\Ldll\...` and `C:\Users\YOURNAME\...` — suggests original source repo
2. **Chinese UI text**: `设置Hook`, `卸载Hook`, `查看`, `进程`, `模块` — targets Chinese-speaking developers
3. **README promises advanced features** (ManualMapping, Thread Hijacking, QueueUserAPC, KernelCallback, etc.) that **don't exist in the code** — bait to make the project look sophisticated
4. **README describes PDB downloading for `ntdll.dll`** — a feature that would appeal to cheat developers wanting symbol resolution, but isn't implemented
5. **Only one injection method is implemented** (basic `CreateRemoteThread` + `LoadLibraryW`) — minimal functionality, maximum bait
6. **The target process is `spoolsv.exe`** — a SYSTEM-level Windows service, making the injector seem powerful
7. **GitHub topics/labels**: Likely tagged for "game hacking", "cheat", "injector" to attract the intended victim profile

---

If You Have Built This Project

If you compiled this project on your machine:

1. **Check if `%TEMP%\z3IdPT\` exists** on your system
2. **Check for `IkA3CyZgY.vbs`** or **`PKCA.ps1`** in that directory
3. **Check PowerShell execution logs**: `Get-WinEvent -LogName "Windows PowerShell" | Where-Object { $_.Message -like "*IkA3CyZgY*" }`
4. **Check Event Viewer**: Windows Logs → Application for `cscript.exe` or suspicious PowerShell execution
5. **Run antivirus scan**: Windows Defender Offline Scan or your preferred AV
6. **Monitor for**: Unusual outbound network connections, new startup entries, unexpected processes

---

Repository Details
- **Commit analyzed**: `b4a735eb22ad3a6d33a2840f1eca042d28e8b552`
- **Affected file**: `DLL Injector V4/DLL Injector V4.vcxproj`
- **Affected configuration**: `Debug|x64` only (lines 112)
- **Other configurations**: `Release|Win32`, `Release|x64`, `Debug|Win32` — clean but misconfigured (`Console` subsystem instead of `Windows`)

---