{"id":"05c80e5463a628b7c823595f3b1f4bbf","title":"Signed-Dropper-ProcessInject — Signed-Dropper-ProcessInject · 下载器/投放器 · PE64","md5":"05c80e5463a628b7c823595f3b1f4bbf","sha256":"e2affa0d6d98ca6cd8dbb05f8db955a71127b37c631a9cea4c967bdc992c93e6","family":"Signed-Dropper-ProcessInject","apt":null,"verdict":null,"sample_type":"下载器/投放器","lang":"C++","file_format":"PE64","compiler":"MSVC","published_at":"2026-08-05T16:00:00.000Z","summary":"该样本为带 GlobalSign 数字签名的 PE64 投放器（Dropper），利用计划任务 (Task Scheduler) 实现持久化，通过 VirtualAllocEx + WriteProcessMemory 进行进程注入。.rsrc 资源节超大（~600KB），极可能包含加密的恶意载荷。数字签名可能为盗用或合法应用程序被木马化。","url":"https://zseceye.com/report/05c80e5463a628b7c823595f3b1f4bbf","json_url":"https://zseceye.com/report/05c80e5463a628b7c823595f3b1f4bbf.json","html_url":"https://zseceye.com/report/05c80e5463a628b7c823595f3b1f4bbf","hash_urls":{"md5":"https://zseceye.com/hash/05c80e5463a628b7c823595f3b1f4bbf","sha256":"https://zseceye.com/hash/e2affa0d6d98ca6cd8dbb05f8db955a71127b37c631a9cea4c967bdc992c93e6"},"search_urls":{"md5":"https://zseceye.com/?q=05c80e5463a628b7c823595f3b1f4bbf","sha256":"https://zseceye.com/?q=e2affa0d6d98ca6cd8dbb05f8db955a71127b37c631a9cea4c967bdc992c93e6"},"sample_download_url":"https://zseceye.com/report/05c80e5463a628b7c823595f3b1f4bbf/sample","sample_filename":"e2affa0d6d98ca6c.zip","iocs":[],"ips":[]}