3045902d7104e67ca88ca54360d9ef5bfe5bec8b575580bc28205ca67eeba96d

Metadata

SHA256: 3045902d7104e67ca88ca54360d9ef5bfe5bec8b575580bc28205ca67eeba96d
Difficulty: advanced
Platform: Windows
Tags: delphi steganography
Likes: 1
Views: 1
Submitter: malcat

Analysis

Goal

Extract the next stage payload with static analysis.

Description

This DBATLoader initial stage uses steganography, meaning the payload is encoded using less-significative bits of an image embedded inside the binary. Find the image and how the payload is encoded

Recommended Tools

ida malcat

Solutions

Exploit, steganography and Delphi: unpacking DBatLoader (part #2) Reference by malcat

Sample