Trainings Samples

Samples

Clear
SHA256 Author Difficulty Tags Goal Solutions Likes Comments Created
dca13fc006a3b55756ae0534bd0d37a1b53a219b5d7de236f20b0262f3662659 struppigel medium
packed stealer electron javascript
Unpack the sample and obtain the config 1 0 04 Feb 2026
c2c466e178b39577912c9ce989cf8a975c574d5febe15ae11a91bbb985ca8d2e struppigel medium
string deobfuscation packed .net injector stage 2 encrypted purecrypter
This is Gnwwcgocwzl.wav. Decrypt this file based on the [previous stage's analysis](https://samplepedia.cc/sample/1c33eef0d22dc54bb2a41af485070612cd4579529e31b63be2141c4be9183eb6/79/). Unpack the payload. Afterwards continue with [payload analysis here](https://samplepedia.cc/sample/45dc4518fbf43bf4611446159f72cdbc37641707bb924bd2a52644a3af5bab76/75/) — 0 27 Jan 2026
361f20f5843a9d609d42fc17f164eb44ed4f86ae3062e66e978c2c93890f65fd struppigel medium
python packed smokedham
LICENSE.txt was run via > %ALLUSERSPROFILE%\Microsoft\AppUpdate\SystemInfo\UsbService86.exe LICENSE.txt UsbService86.exe has the signer **Python Software Foundation** Decompile the code, then create a binary refinery pipeline to unpack the next layers. (CyberChef might be an alternative, but I did not check if it has all necessary algorithms) 1 1 23 Jan 2026
45dc4518fbf43bf4611446159f72cdbc37641707bb924bd2a52644a3af5bab76 struppigel medium
.net obfuscated .netreactor agenttesla stage 3
If you want to analyze the full infection chain, start with [the first stage here](https://samplepedia.cc/sample/1c33eef0d22dc54bb2a41af485070612cd4579529e31b63be2141c4be9183eb6/79/) Your task is to extract the configuration. — 0 16 Jan 2026
4029f9fcba1c53d86f2c59f07d5657930bd5ee64cca4c5929cbd3142484e815a larsborn medium
string deobfuscation
Identify and reverse engineer the API hashing function. Emulate it with an appropriate string list to confirm your findings. 1 0 13 Jan 2026
4029f9fcba1c53d86f2c59f07d5657930bd5ee64cca4c5929cbd3142484e815a larsborn medium
string deobfuscation
Identify and reverse engineer the string deobfuscation function in this sample. Write a binary refinery pipeline to emulate it. Bonus points if you manage to write a Ghidra script. 1 0 13 Jan 2026
67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d larsborn medium
string deobfuscation
Find and reverse engineer the string deobfuscation function in the sample. Create a binary refinery pipeline to decrypt the strings. Bonus points if you manage to write a Ghidra script to decrypt them all. 1 0 13 Jan 2026
2299ff9c7e5995333691f3e68373ebbb036aa619acd61cbea6c5210490699bb6 struppigel medium
js macro office apt kopiluwak turla vba
Create a C2 extractor using a Python script, binary refinery pipeline or CyberChef recipie — 0 11 Jan 2026
ee69b74d0f0dd59fcd87304863626efb727ad6255bc29a7d48b7a441390dff1a struppigel medium
packed autoit cypherit obfuscated
This is packed by CypherIt crypter. Unpack the malware. Bonus: Extract the config of the payload. 1 0 11 Jan 2026
e7cf02ad880e8ebb37134c5370189bd2620ce1bf60794aa8776db6ccc4d4f0f7 struppigel medium
loader d3f@ck jphp jvm stage 2
Decompile the main malware code and figure out where it downloads the next stage. If the download URL is not available anymore, the deaddrop URL will suffice. This ZIP archive is downloaded by this [InnoSetup sample](https://samplepedia.cc/sample/7409250e8be3bdcdaa756faff2150b13677ae066e42cefa52844c87451f6f60d/54/). You may want to start analyzing there. 2 0 09 Jan 2026
7409250e8be3bdcdaa756faff2150b13677ae066e42cefa52844c87451f6f60d struppigel medium
string deobfuscation loader d3f@ck inno stage 1
Extract the InnoSetup script and decode the strings. Figure out the download URL statically. Afterwards continue with [the next stage](https://samplepedia.cc/sample/e7cf02ad880e8ebb37134c5370189bd2620ce1bf60794aa8776db6ccc4d4f0f7/55/) 1 0 09 Jan 2026
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93 larsborn medium
string deobfuscation ransomware revil
Find and analyze the string decryption/deobfuscation function. Determine the cryptographic algorithm being used and the memory layout of the encrypted data and key material. Try to emulate it with your tooling of choice, Binary Refinery is a good recommendation. 1 0 07 Jan 2026
0b38ca277bbb042d43bd1f17c4e424e167020883526eb2527ba929b2f0990a8f larsborn medium
obfuscated rat windows scripting
Circumvent unnecessary API calls by NOPing them out 1 0 05 Jan 2026
94237eac80fd2a20880180cab19b94e8760f0d1f06715ff42a6f60aef84f4adf humpty_tony medium
python stealer
This post’s goal is to show how you reverse a “boring” stealer by treating the loader chain as the real specimen. Peel multi-stage Python loaders safely: - Identify and undo container transforms (reverse bytes + zlib). - Recognize when crypto code is “almost right” but relies on a modified library (the PyAES GCM mismatch), then swap in a compatible implementation to decrypt without executing. - Deal with Python marshalled bytecode. - Reduce obfuscation to primitives (base64 aliasing, rot13, marshal.loads, LZMA/XZ payloads, BlankOBF patterns), so you can turn “giant blob soup” into discrete stages you can write to disk, identify with file, and decompile. So the analysis goal is basically: build a repeatable methodology for unpacking + staging + version-correct decompilation of Python malware—because that workflow applies to tons of commodity stealers and loaders. 1 1 04 Jan 2026
5bed39728e404838ecd679df65048abcb443f8c7a9484702a2ded60104b8c4a9 humpty_tony medium
api hashing anti-vm supply chain
This post’s goal is to teach someone how to take a “real-world” supply-chain DLL dropper/loader and turn it into a set of actionable reversing primitives: - Reconstruct the full execution chain from NPM install hook → rundll32 execution of a shipped DLL export → staged loader → staged stealer, and understand where “initial access” ends and “payload logic” begins. - Deobfuscate a modern loader’s internals efficiently by focusing on the repeatable patterns that matter: - PEB-walking + import hashing - Encrypted static strings - Hook checks + indirect syscalls - Extract a protocol/crypto story from messy networking code, even if you don’t fully reverse the C2 1 0 04 Jan 2026
61f8224108602eb1f74cb525731c9937c2ffd9a7654cb0257624507c0fdb5610 humpty_tony medium
rat revshell windows
- Reconstructing the execution entrypoint of a DLL implant - Dealing with weird socket usage - Deriving crypto/obfuscation primitives from code - Map "capabilities" to specific code paths and artifacts - Recognize and analyze persistence 1 0 04 Jan 2026
4109d17d439e425d24e9d11956adcc63ff8e24ccfffe21dd8c5431fe969d2783 malcat medium
powershell config extraction cobal strike
Extract the cobal strike configuration. 1 0 04 Jan 2026
Page 1 of 2