5544e6c66cbf6503cddef2797acbff4fb81ededaef2334a596e6484cfaa0b8e8
|
struppigel
|
medium
|
|
Unpack the payload. This can be done either with a debugger or using only static unpacking with binary refinery. Note: The payload is obfuscated with VMProtect, deobfuscating it is not part of the task.
|
1
|
|
0
|
26 Dec 2025
|
0d7e7c6c1e02f7e5e5d0bf8f191e9d50636e71cabc2b4883d112b0f04da3d9f0
|
struppigel
|
advanced
|
|
Write a script or program that deobfuscates the strings and patches the assembly with the deobfuscated strings
|
1
|
|
0
|
26 Dec 2025
|
482a8b7ead1e07ac728e1e2b9bcf90a26af9b98b15969a3786834d6e81d393cd
|
struppigel
|
easy
|
|
What's the password for the screenlocker? Extract the code.
|
1
|
|
1
|
26 Dec 2025
|
aad0a60cb86e3a56bcd356c6559b92c4dc4a1a960f409fb499cf76c9b5409fdb
|
struppigel
|
easy
|
|
Markup the sample in Ghidra/IDA/Binary Ninja
|
1
|
|
0
|
26 Dec 2025
|
3c086e76942fb9fd3d1e4384e9c1228c227c00c78dc29fca512ed95ee919ee5e
|
struppigel
|
medium
|
|
This application consists of almost 3000 files. Find proof that the sample is malicious by finding the malicious code. A weird filename with homoglyphs is not enough, nor is behavioral analysis in a sandbox.
|
1
|
|
0
|
26 Dec 2025
|