Indirect Calls

CDEF-$tealer

March 3, 2026

Malware Analysis Reverse Engineering PE DLL Windows Dridex Loader Heaven's Gate Dynamic API Resolution Indirect Calls Vectored Exception Handling Anti-Debugging Anti-VM RC4 CRC32 IDA Capa HashDB CAPEv2

A Dridex loader DLL that dynamically resolves APIs via CRC32 hashing, uses int3/retn as an indirect call mechanism to evade analysis, decrypts embedded strings with RC4, and connects to four hardcoded C2 servers over HTTPS to download additional modules.

↑