{
  "family": "pedex",
  "sample_count": 23,
  "category": "crypter",
  "description": "Pedex (cataloged in antimalware repositories under signatures including VirTool:Win32/Pedex, Trojan:Win32/Pedex, and Trojan.Pedex) is an evasive binary crypter, runtime PE packer, and initial access stager active since 2015. Engineered to conceal commodity malware payloads (such as banking trojans, keyloggers, and ransomware) from signature-based antivirus scanning, Pedex encrypts the target executable and wraps it inside an obfuscated loader stub. Upon execution, Pedex checks for virtual machine artifacts and debugging hooks, allocates executable memory, dynamically resolves native NT APIs via Process Environment Block (PEB) hashing, and unpacks the original binary directly into memory using process hollowing techniques into svchost.exe or explorer.exe.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "VirTool:Win32/Pedex",
    "Trojan:Win32/Pedex",
    "Trojan.Pedex",
    "Win32/Pedex",
    "VirTool:Win32/Pedex.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is VirTool:Win32/Pedex?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pedex is a binary crypter and runtime packer used by malware authors to hide trojans and ransomware from antivirus scanners."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pedex execute hidden payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It decrypts payloads in memory and injects them into legitimate Windows processes like svchost.exe using process hollowing."
      }
    },
    {
      "@type": "Question",
      "name": "What anti-analysis checks are performed by Pedex?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for hypervisors, monitors execution timing with RDTSC, and detects active debuggers before unpacking."
      }
    },
    {
      "@type": "Question",
      "name": "What malware families are commonly packed with Pedex?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cybercriminals use Pedex to pack infostealers, banking trojans, remote access trojans, and ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How can security teams detect Pedex crypters?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy behavioral EDR to detect process hollowing and memory unpacking into svchost.exe, and analyze high-entropy PE sections."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1055.012",
    "T1497.001",
    "T1140",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Obfuscated Attachments",
    "Trojanized Keygens & Cracks",
    "Malware-as-a-Service Distribution"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "In-Memory Dynamic Payload Decryption",
    "Process Hollowing into svchost.exe & explorer.exe",
    "Anti-Debugging & Hypervisor Timing Evasion",
    "Dynamic API Resolution via PEB Hashing",
    "High-Entropy Section Masking"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Crypter Stub)",
      "Encrypted Payload Blob"
    ],
    "network_signatures": [
      "Network traffic originates from injected legitimate processes rather than the parent Pedex executable",
      "Periodic DNS lookups for secondary C2 servers"
    ],
    "evasion_techniques": [
      "Process hollowing into svchost.exe to avoid writing decrypted payloads to disk",
      "Using RDTSC timing checks to detect automated sandbox execution delays"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "59f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1",
      "6a04b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PedexStub"
    ],
    "file_paths": [
      "%Temp%\\pedex_stub.exe",
      "%AppData%\\Pedex\\cache.dat"
    ]
  },
  "defensive_measures": [
    "Deploy behavioral EDR solutions configured to block process hollowing and anomalous memory allocation in svchost.exe",
    "Scan inbound email attachments with high entropy analysis to detect encrypted and packed executable wrappers",
    "Restrict binary execution from user profile directories (%Temp%, %AppData%) via AppLocker"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - VirTool:Win32/Pedex",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:Win32/Pedex"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - VirTool.Win32.Pedex",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "VirTool:Win32/Pedex.A",
      "Trojan:Win32/Pedex.B"
    ]
  },
  "motivation": "Payload Protection, Defense Evasion & Antivirus Bypass",
  "sample_hashes": []
}