Exetools - Malware Analysis

Exetools (https://forum.exetools.com/index.php)

- General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)

- - Malware Analysis (https://forum.exetools.com/showthread.php?t=21220)

ldmd	03-07-2025 17:39

Malware Analysis

Recently, I shifted from working on crackmes to malware analysis. I tried to write a blog covering some aspects, as detailing everything I did would have made it too long. However, I’m not quite satisfied with what I have written. I’d really appreciate it if you could take a look and provide feedback.

Blog: https://www.mblog.pro/blog/malware

The sample I analyzed is from MalwareBazaar, and here is a VirusTotal link:
https://www.virustotal.com/gui/file/3fef5c7fa519f5384de6f61c954ead6dfd4da727005bfec954dc801bd120a938

sendersu

03-08-2025 02:24

hmm
is your site kind of ctf?

https://prnt.sc/xne6zKOkRfXf

ldmd	03-08-2025 17:51

Quote:

Originally Posted by sendersu (Post 132797)

hmm
is your site kind of ctf?

https://prnt.sc/xne6zKOkRfXf

Nope, https://prnt.sc/A_2ouiw-OdHf

JMP-JECXZ

03-08-2025 20:33

you need to activate javascript otherwise site is broken.

ldmd	03-08-2025 22:50

Quote:

Originally Posted by JMP-JECXZ (Post 132800)

you need to activate javascript otherwise site is broken.

I didn't intend for the blog to be for a js-disabled browser, so sorry.

tonyweb

03-09-2025 01:58

A quick look can be taken if you execute something like the following in your browser console:

Code:

document.querySelectorAll(".animate").forEach( elem => { elem.style.opacity = 1 } );

sendersu

03-09-2025 02:55

@tonyweb - means no JS in my lovely Opera?
I dont remember I've deliberately turned it OFF hm hm

https://prnt.sc/0uUfVEVg9SQT

tonyweb

03-09-2025 18:42

@sendersu
I don't see errors in your screenshot (that warning is there to avoid the average user executing whichever javascript snippet found online, without understanding what it does).

Of course you can do it "manually", locating the suitable "main" child-tag inside page source and unchecking the opacity rule.

https://gcdnb.pbrd.co/images/0nwENvl9sHJU.png

All times are GMT +8. The time now is 15:24.