Ransomware infecting user32.dll, continued
Analysis of the increased resource section in this file shows that it contains an encrypted payload with a decryptor embedded. We will show how the malware gets active once it has successfully infected the user32.dll file. EntryPoint patched The code in t...