The Story Of A Trojan Dropper II

This report analyzes a packed Windows PE sample that performs in-memory decryption and execution of position-independent shellcode, resolves APIs by hashed names, decompresses an embedded PE (aplib), rebuilds its IAT in memory, drops a secondary executable named "Adobe.exe" to the temporary folder, and executes it while also creating a dummy PDF file; the analysis documents the unpacking, decryption, and execution flow and notes upcoming analysis of the dropped payload.