Author
Arkadiusz Marta
00000000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 |MZ..............| 00000010 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 |........@.......| 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000030 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 |................| 00000040 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000050 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000060 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000070 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......| 00000080 50 45 00 00 64 86 06 00 c3 a2 f1 66 00 00 00 00 |PE..d......f....| 00000090 00 00 00 00 f0 00 22 00 0b 02 0e 26 00 9e 01 00 |......"....&....| 000000a0 00 c4 00 00 00 00 00 00 f0 a2 01 00 00 10 00 00 |................| 000000b0 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 |...@............| 000000c0 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 |................| 000000d0 00 d0 02 00 00 04 00 00 d4 f1 02 00 03 00 60 81 |..............`.| 000000e0 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 |................| 000000f0 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 |................| 00000100 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 |................| 00000110 40 3a 02 00 b4 00 00 00 00 b0 02 00 e0 01 00 00 |@:..............| 00000120 00 90 02 00 90 12 00 00 00 00 00 00 00 00 00 00 |................| 00000130 00 c0 02 00 c0 06 00 00 30 1e 02 00 70 00 00 00 |........0...p...| 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000150 00 00 00 00 00 00 00 00 a0 1e 02 00 40 01 00 00 |............@...| 00000160 00 00 00 00 00 00 00 00 00 b0 01 00 a8 03 00 00 |................| 00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000180 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 |.........text...| 00000190 4c 9d 01 00 00 10 00 00 00 9e 01 00 00 04 00 00 |L...............| 000001a0 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 |............ ..`| 000001b0 2e 72 64 61 74 61 00 00 6e bc 00 00 00 b0 01 00 |.rdata..n.......| 000001c0 00 be 00 00 00 a2 01 00 00 00 00 00 00 00 00 00 |................| 000001d0 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 |....@..@.data...| 000001e0 58 1e 00 00 00 70 02 00 00 08 00 00 00 60 02 00 |X....p.......`..| 000001f0 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 |............@...| 00000200 2e 70 64 61 74 61 00 00 90 12 00 00 00 90 02 00 |.pdata..........| 00000210 00 14 00 00 00 68 02 00 00 00 00 00 00 00 00 00 |.....h..........| 00000220 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 |....@..@.rsrc...| 00000230 e0 01 00 00 00 b0 02 00 00 02 00 00 00 7c 02 00 |.............|..| 00000240 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 |............@..@| 00000250 2e 72 65 6c 6f 63 00 00 c0 06 00 00 00 c0 02 00 |.reloc..........| 00000260 00 08 00 00 00 7e 02 00 00 00 00 00 00 00 00 00 |.....~..........| 00000270 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 |....@..B........| 00000280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000400 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 48 |H.\$.H.t$.WH.. H| 00000410 8b f9 48 8d 0d d5 2b 02 00 ff 15 ef ec 01 00 48 |..H...+........H| 00000420 8b d8 48 85 c0 74 3a 48 8d 15 c8 2b 02 00 48 8b |..H..t:H...+..H.| 00000430 c8 ff 15 e7 ec 01 00 48 8b f0 48 85 c0 74 21 41 |.......H..H..t!A| 00000440 b9 40 00 00 00 41 b8 00 30 00 00 ba 00 10 00 00 |.@...A..0.......| 00000450 33 c9 ff d6 48 8b 5c 24 30 48 8b 74 24 38 48 83 |3...H.\$0H.t$8H.| 00000460 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc |. _.............|
00000000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 |MZ..............| 00000010 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 |........@.......| 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000030 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 |................| 00000040 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000050 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000060 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000070 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......| 00000080 50 45 00 00 64 86 06 00 c3 a2 f1 66 00 00 00 00 |PE..d......f....| 00000090 00 00 00 00 f0 00 22 00 0b 02 0e 26 00 9e 01 00 |......"....&....| 000000a0 00 c4 00 00 00 00 00 00 f0 a2 01 00 00 10 00 00 |................| 000000b0 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 |...@............| 000000c0 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 |................| 000000d0 00 d0 02 00 00 04 00 00 d4 f1 02 00 03 00 60 81 |..............`.| 000000e0 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 |................| 000000f0 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 |................| 00000100 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 |................| 00000110 40 3a 02 00 b4 00 00 00 00 b0 02 00 e0 01 00 00 |@:..............| 00000120 00 90 02 00 90 12 00 00 00 00 00 00 00 00 00 00 |................| 00000130 00 c0 02 00 c0 06 00 00 30 1e 02 00 70 00 00 00 |........0...p...| 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000150 00 00 00 00 00 00 00 00 a0 1e 02 00 40 01 00 00 |............@...| 00000160 00 00 00 00 00 00 00 00 00 b0 01 00 a8 03 00 00 |................| 00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000180 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 |.........text...| 00000190 4c 9d 01 00 00 10 00 00 00 9e 01 00 00 04 00 00 |L...............| 000001a0 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 |............ ..`| 000001b0 2e 72 64 61 74 61 00 00 6e bc 00 00 00 b0 01 00 |.rdata..n.......| 000001c0 00 be 00 00 00 a2 01 00 00 00 00 00 00 00 00 00 |................| 000001d0 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 |....@..@.data...| 000001e0 58 1e 00 00 00 70 02 00 00 08 00 00 00 60 02 00 |X....p.......`..| 000001f0 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 |............@...| 00000200 2e 70 64 61 74 61 00 00 90 12 00 00 00 90 02 00 |.pdata..........| 00000210 00 14 00 00 00 68 02 00 00 00 00 00 00 00 00 00 |.....h..........| 00000220 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 |....@..@.rsrc...| 00000230 e0 01 00 00 00 b0 02 00 00 02 00 00 00 7c 02 00 |.............|..| 00000240 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 |............@..@| 00000250 2e 72 65 6c 6f 63 00 00 c0 06 00 00 00 c0 02 00 |.reloc..........| 00000260 00 08 00 00 00 7e 02 00 00 00 00 00 00 00 00 00 |.....~..........| 00000270 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 |....@..B........| 00000280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000400 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 48 |H.\$.H.t$.WH.. H| 00000410 8b f9 48 8d 0d d5 2b 02 00 ff 15 ef ec 01 00 48 |..H...+........H| 00000420 8b d8 48 85 c0 74 3a 48 8d 15 c8 2b 02 00 48 8b |..H..t:H...+..H.| 00000430 c8 ff 15 e7 ec 01 00 48 8b f0 48 85 c0 74 21 41 |.......H..H..t!A| 00000440 b9 40 00 00 00 41 b8 00 30 00 00 ba 00 10 00 00 |.@...A..0.......| 00000450 33 c9 ff d6 48 8b 5c 24 30 48 8b 74 24 38 48 83 |3...H.\$0H.t$8H.| 00000460 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc |. _.............|
RE:SØURCERE:SØURCERE:SØURCERE:SØURCERE:SØURCE
Notes and technical writeups on malware campaigns and web-application vulnerabilities, based on real cases encountered in the field.
S.04 · FEATURED
CVE-2026-34747 - Payload CMS SQL Injection
An SQL injection in Payload CMS exposes the underlying database through a single crafted request.
CVE · SQLI · PAYLOAD · WEBAPPREAD ↗
Stories · 2026
4
Focus areas
MALWARE · WEBAPP
More from the archive.
2 RECENT POSTS
S.03 · ↗
CVE-2026-28501 - AVideo Unauthenticated SQL Injection
A critical SQL injection in AVideo allows unauthenticated remote attackers to exfiltrate the entire database by smuggling a single JSON field past the application's global input sanitizer.
CVESQLIAVIDEOWEBAPP
S.02 · ↗
Ledger Wallet Impersonation Analysis
Diving into a fake Ledger Live macOS app that tricks users into entering their recovery phrase and silently sends it to an attacker.
MacOSMalwareCrypto-Stealer