5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93
|
larsborn
|
medium
|
|
Find and analyze the string decryption/deobfuscation function. Determine the cryptographic algorithm being used and the memory layout of the encrypted data and key material. Try to emulate it with your tooling of choice, Binary Refinery is a good recommendation.
|
1
|
|
0
|
07 Jan 2026
|
5bed39728e404838ecd679df65048abcb443f8c7a9484702a2ded60104b8c4a9
|
humpty_tony
|
medium
|
|
This post’s goal is to teach someone how to take a “real-world” supply-chain DLL dropper/loader and turn it into a set of actionable reversing primitives:
- Reconstruct the full execution chain from NPM install hook → rundll32 execution of a shipped DLL export → staged loader → staged stealer, and understand where “initial access” ends and “payload logic” begins.
- Deobfuscate a modern loader’s internals efficiently by focusing on the repeatable patterns that matter:
- PEB-walking + import hashing
- Encrypted static strings
- Hook checks + indirect syscalls
- Extract a protocol/crypto story from messy networking code, even if you don’t fully reverse the C2
|
1
|
|
0
|
04 Jan 2026
|
5bc8b1a067ec4b487e88c2bb93728158633f4fdf22b111d5562cbb4ad3426d30
|
struppigel
|
medium
|
|
Deobfuscate this loader such that you get the download URL.
|
2
|
|
0
|
04 Jan 2026
|
57e497bf62138b926d4adab395e0ab64f9f1b606ff9219e0c004fcc5a8348f7a
|
struppigel
|
medium
|
|
Find the code that is responsible for loading the next stage. Figure out the download URL for the next stage with emulation.
|
—
|
|
0
|
17 Mar 2026
|
56f5623daa470bee190ae0ecd961be8e6df71c8da1ccf7b268fe876b84c183d9
|
struppigel
|
easy
|
|
Where does this file load the next stage from?
|
3
|
|
3
|
20 Jan 2026
|
55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396
|
0xdeluks
|
easy
|
|
Deobfuscate the strings and identify the functionality of all commands.
|
3
|
|
3
|
05 Jan 2026
|
5544e6c66cbf6503cddef2797acbff4fb81ededaef2334a596e6484cfaa0b8e8
|
struppigel
|
medium
|
|
Unpack the payload. This can be done either with a debugger or using only static unpacking with binary refinery. Note: The payload is obfuscated with VMProtect, deobfuscating it is not part of the task.
|
1
|
|
0
|
26 Dec 2025
|
4eb33ce768def8f7db79ef935aabf1c712f78974237e96889e1be3ced0d7e619
|
larsborn
|
easy
|
|
Identify and reverse engineer the string deobfuscation function. Bonus points if you can write a Ghidra script to emulate it.
|
1
|
|
0
|
13 Jan 2026
|
4ada609d908afd3bb171ab8287cd2ada2cf112c80c9786e10441d68d979caa4c
|
struppigel
|
medium
|
|
Deobfuscate the sample.
How does the domain name generation work?
How does this sample receive and execute code from the attacker?
|
—
|
|
0
|
19 Jun 2026
|
49660527c1c910ad2d3c5625c1b44682e465e45b65883dfc8d7d229d1bd0ebd8
|
struppigel
|
advanced
|
|
Extract the main.js, decompile and deobfuscate it so far that you can see the webhook
|
1
|
|
0
|
07 Mar 2026
|
482a8b7ead1e07ac728e1e2b9bcf90a26af9b98b15969a3786834d6e81d393cd
|
struppigel
|
easy
|
|
What's the password for the screenlocker? Extract the code.
|
1
|
|
1
|
26 Dec 2025
|
478d992c999a0e93ada1c9aa10644e3abdc207d407492c5bc2710986de4d42be
|
struppigel
|
easy
|
|
Where does this office document get the next stage and how?
When was the document created?
|
1
|
|
0
|
25 Apr 2026
|
465dc7a1068d0c7d31b4ffb0a013a59ddd0320dde4389748eed99f41ee0f51ae
|
struppigel
|
medium
|
|
How does this rootkit hide loaded modules of a process? Locate the function that is responsible for that. What's necessary to trigger the module hiding?
|
—
|
|
0
|
21 Feb 2026
|
45dc4518fbf43bf4611446159f72cdbc37641707bb924bd2a52644a3af5bab76
|
struppigel
|
medium
|
|
If you want to analyze the full infection chain, start with [the first stage here](https://samplepedia.cc/sample/1c33eef0d22dc54bb2a41af485070612cd4579529e31b63be2141c4be9183eb6/79/)
Your task is to extract the configuration.
|
1
|
|
0
|
16 Jan 2026
|
4109d17d439e425d24e9d11956adcc63ff8e24ccfffe21dd8c5431fe969d2783
|
malcat
|
medium
|
|
Extract the cobal strike configuration.
|
1
|
|
0
|
04 Jan 2026
|
4029f9fcba1c53d86f2c59f07d5657930bd5ee64cca4c5929cbd3142484e815a
|
larsborn
|
medium
|
|
Identify and reverse engineer the API hashing function. Emulate it with an appropriate string list to confirm your findings.
|
2
|
|
0
|
13 Jan 2026
|
4029f9fcba1c53d86f2c59f07d5657930bd5ee64cca4c5929cbd3142484e815a
|
larsborn
|
medium
|
|
Identify and reverse engineer the string deobfuscation function in this sample. Write a binary refinery pipeline to emulate it. Bonus points if you manage to write a Ghidra script.
|
1
|
|
0
|
13 Jan 2026
|