Karsten Hahn

I created an extraction script for custom PyInstaller applications as seen in suspected EvilAI PDF apps.

Script (modified pyinstxtractor-ng): github.com/struppigel/h...

Article: samplepedia.cc/sample/8c9d9...

#Samplepedia updates

* you can upload images for articles
* view count for samples and articles
* expert difficulty available
samplepedia.cc

anyPDF decompilation - a highly evasive, fully undetected, signed PDF editor bundled with AdClicker Trojan and Spyware In this post, we will decrypt a highly evasive C# malicious sample that is fully undetected and inspect it's source code using dnSpy.

anyPDF malware analysis report

rifteyy.org/report/anypd...

That's very useful, thank you!

Samples are in samplepedia.cc?tag=openxml

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - Malicious MS Office files without Macros

🦔 📹 New Video: Can office files be malicious without Macros?

➡️ VSTO Add-Ins
➡️ External Templates
➡️ Checklist for Office analysis
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=RtHH...

If you like binary refinery, check out this sample
It's also mostly undetected yet on VT:
samplepedia.cc/sample/361f2...

YouTube video by Invoke RE Floxif File Infector with Control Flow Obfuscation Analysis (Stream - 06/01/2026)

@invokereversing.bsky.social is analyzing Floxif with binary ninja
👇
www.youtube.com/watch?v=2F_B...

Samplepedia update: Users can submit their own images with the samples and there is a platform field.

samplepedia.cc

I have created a website, where you can share your sample analysis (via links or posts) and search samples for training based on tags and difficulty.

If you write analysis blogs, you can share them there.
samplepedia.cc

hedgehog-tools/Python helper scripts/monitor_and_dump_changed_files.py at main · struppigel/hedgehog-tools Contribute to struppigel/hedgehog-tools development by creating an account on GitHub.

I added a python script to monitor a folder during dynamic analysis and dump changed files with timestamp

github.com/struppigel/h...

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - RenPy game, finding malware code in 2956 files, Beginner friendly

🦔 📹New Video: RenPy game loads stealer, beginner friendly
➡️ strategies for finding malware in 2956 files
➡️ extracting and decompiling RenPy
➡️ remote access tool config extraction
➡️ unpacking native payload
#MalwareAnalysisForHedgehogs #RenPy
www.youtube.com/watch?v=Fmfg...

Browser Hijacking: Three Technique Studies If you are searching for technical information on how browser hijacking works, there does not seem to be much out there apart from generic removal instructions. This might be an educational gap we sho...

New blog: Browser Hijacking techniques -- when malware has different preferences than you

www.gdatasoftware.com/blog/2025/11...

#GDATA #GDATATechblog #BrowserHijacking

hedgehog-tools/RenPy at main · struppigel/hedgehog-tools Contribute to struppigel/hedgehog-tools development by creating an account on GitHub.

I added a RenPy archive (.rpa, .rpi) extractor to my tools repo

github.com/struppigel/h...

Arkanix: New Infostealer grabs Browser Data, Wifi Logins, Cryptowallets G DATA researcher Banu Ramakrishnan has discovered a previously undocumented infostealer malware called Arkanix. Learn about the details in the G DATA blog!

My colleague Banu wrote about a new infostealer Arkanix
www.gdatasoftware.com/blog/2025/12...

I am not sure. Probably part of his trainings.

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - Defeating ConfuserEx Anti-Analysis with Hooking

🦔📹 New Video: Modifying string decrypter for a ConfuserEx2 variant
➡️ Defeating antis with Harmony hooks
➡️ AsmResolver
➡️ .NET string deobfuscation
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=sARn...

Courses

Black Friday offers:
60% off for 2 malware analysis courses (beginner & intermediate)
Or 40% off for single course

malwareanalysis-for-hedgehogs.learnworlds.com/courses

YouTube video by mr_phrazer SP25: Anti Tamper

Lecture on Anti Tamper by Tim Blazytko www.youtube.com/watch?v=hQi9...

Rhadamanthys loader deobfuscation
cyber.wtf/2025/11/19/r...

I am suggesting a new malware type: the browser remote access tool (BRAT)

It's a form of browser hijacker that remotely controls your browser based on server commands.

Typical form: press key combos for copy-pasting URLs, opening tabs, context menu, downloading files etc

For anyone who wants to understand certificates better and how to spot abuse,
this is a great read
certcentral.org/training

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - Trojanized NordVPN Setup, Beginner Sample

🦔 📹 Video: Analysis of malicious NordVPN setup
➡️ beginner-suitable
➡️ sorry, no spoilers here ;)

www.youtube.com/watch?v=5-OY...

#MalwareAnalysisForHedgehogs

I am looking for good resources for Linux malware analysis, including books and courses.
If you have any recommendations please let me know.

Thank you @threatresearch.bsky.social

My #VirusBulletin2025 loot 😍
I also met someone from vxunderground and all I got was this lousy sticker

Infected Steam game downloads malware disguised as patch A 2D platformer game called BlockBlasters has recently started showing signs of malicious activity after a patch release on August 30. While the user is playing the game, various bits of information a...

Steam game BlockBlasters downloads malware
written by Arvin Tan

#GDATATechblog @GDATA #GDATA
www.gdatasoftware.com/blog/2025/09...

AppSuite, OneStart & ManualFinder: The Nexus of Deception Having taken a look at AppSuite in one of our last articles, we have started pulling on a few loose threads to see where it would take us. It turns out that there are relationships with other maliciou...

My colleague Banu wrote about the connection between AppSuite, OneStart and ManualFinder

www.gdatasoftware.com/blog/2025/09...

Invite link for our Discord expired, because I did not change the default limit.
Here is a new one, this time without limit

discord.gg/8xB38EedHT

YouTube video by MalwareAnalysisForHedgehogs Malware Theory - What breakpoints to set for unpacking

🦔 📹 New video: What breakpoints to set for unpacking malware?
➡️ Steps of unpacking stub
➡️ Breakpoint targets
➡️ VirtualAlloc from user to kernel mode

#MalwareAnalysisForHedgehogs #Unpacking
www.youtube.com/watch?v=fn8r...