Dridex Hackers Zone

time to move to another tutorial on how to spread your virus!

I will post another working demo and instructions for you later one

Modify it to 00142672 and save it as ntdll(AddPayload).dll Use LordPEverify checksum, success So far, on the premise that the digital certificate of the PE file is valid, the Payload has been successfully added at the end of the PE file Note: The length of the added payload needs to be an integer multiple of 8, otherwise the digital signature status will be displayed as invalid

Use CFF Explorerto open the PE file, select Nt Header-Optional Header, and find the CheckSum item The original checksum is 0013E00E, as shown in the figure

Click "?" to update it, as shown in the figure, the new checksum is 00142672

6. Modify the PE file checksum Use LordPEto open the PE file, as shown in the figure, the checksum of the original file is 0013E00E

After saving, the signature is successfully recognized, as shown in the figure

5. Add payload Use Hex Editorto add payload at the end of the file As shown

Save the file, view the file information, the signature is invalid (because the payload has not been added) As shown

Certificate Size in Optional Header 00003930 is modified to 0000393A, as shown in the figure

Certificate Size in Optional Header Use to CFF Explorerview the dll structure, select Nt Header-Optional Header-Data Directories [x], find the Security Directory Size item, as shown in the figure