Check if a process is running with admin rights */

The most common anti-disassembly technique seen in the wild is two back-to back conditional jump instructions that both point to the same target. For

This technique is composed of a single conditional jump instruction placed where the condition will always be the same. */

If function pointers are used in handwritten assembly or crafted in a nonstandard way in source code, the results can be difficult to reverse enginee

By using a data byte placed strategically after a conditional jump instruction with the idea that disassembly starting at this byte will prevent the

The most obvious result of this technique is that the disassembler doesn�t show any code cross - reference to the target being jumped to. */

Check whatever InjectedDLL.dll was loaded, because this dll does not provide any other way of caller notification.

Filter for removable disk, CD-ROM, network drive or RAM disk */

Check if the file name contains any of the following strings. This is likely an automated malware sandbox. */

Check for hostnames associated with sandboxes */

Check for usernames associated with sandboxes */

Check against kvm blacklisted files */

Check against kvm registry keys */

Check if the DLL is loaded in the context of the process */

Check for looking-glass-host & VDD processes list.exe https://looking-glass.io (Used in Hypervisor Phantom) https://github.com/Scrut1ny/Hypervisor-Pha

Check for a combination of environmental conditions, replicating what malware could/has used to detect that it's running in a sandbox. */

Check against Parallels registry keys */

Check against blacklisted directories. */