[hf_l33t]

[size=medium][b]Hey guys i have a challenge for all of you just try to Crack it & you will have a secret message on it ..

Well after you crack it PM me the Message and the Method you used: in short

But i think no one can crack it including Kobac in HF

VIRUS SCAN :- http://my-avscan.com/result.php?scan=MTU5MzI=
[color=#FFD700]
[deleted]

[MultiMedio]

Nice i dident manage to crack :' (, btw kobac can easily crack. u just remove the hole system.

Remmember: Nothing is UnCrackabel, but u can make it hard as fuck.

[[email protected]]

Cant crack it Bro its too hard...
I think nobody can crack it...

[pr0t0typ3]

Looks like a bad try to infect HF.

[Nazworth]

Looks like a bad try to infect HF.

Haha, I'm glad you pointed that out. There shouldn't be a RunPE in a crack me :)

[Elbobo]

i also noticed it(the pe dropped in memory) tried to access mozilla sqlite dll's, its trying to steal passwords :/

[pr0t0typ3]

Uhm a .net crack me does not need a RunPE and a installation routine.
Even if you would store hashes (wtf has this to do with a RunPE) you don't need to install your application to startup.

[Helios.]

Looks like a bad try to infect HF.

And it seems that his "Forum" (hackforall.com) that is in his signature is not so innocent as his application:

Virustotal url scan: http://www.virustotal.com/file-scan/repo...1303317398

Anubis (here we can see and memory functions): http://anubis.iseclab.org/?action=result...format=pdf or http://anubis.iseclab.org/?action=result...ormat=html

[StaTiX]

Looks like a bad try to infect HF.

lmao

op shud at least obfuscate his shit if he wants to infect members

[Infinitus]

Looks like a bad try to infect HF.

How did you get to bejn.dll I only see amir.exe, but maybe that's only me.

[Blue Screen of Death]

He replaced the download link?
I opened that file in .net Reflector and looks legit:|

[pr0t0typ3]

He replaced the download link?
I opened that file in .net Reflector and looks legit:|

I unpacked the file -.-
He the part you can see is the loader which does get the actually application from resources and invokes it in memory and I unpacked it...

[Infinitus]

I unpacked the file -.-
He the part you can see is the loader which does get the actually application from resources and invokes it in memory and I unpacked it...

Would you mind telling me how you did that?

[StaTiX]

I unpacked the file -.-
He the part you can see is the loader which does get the actually application from resources and invokes it in memory and I unpacked it...

do you mean this ?
Spoiler (Click to View)

Code

TVqQ$$M$$$$E$$$$//8$$Lg$$Q$$2$$4fug4$t$nNIbg!TM0hVGhpcy!wcm9ncmFtIGNhbm5vdC!iZS!ydW4gaW4gRE9TIG1vZGUuDQ0KJ$$TDRSjV2x68Fdsev!XbHrwV2x68F9sevC/c3HwVmx68NRwdP!$bHrwNXNp8F5sev!XbHvwMWx68L9zcP$3bHrw72p88FZsev!SaWNoV2x68$$UEU$$Ew!!$$/yeVL$$Dg$$8!CwEG$$!w!$$$0$$HUR!$$$E$$$$I$E$$$$Q$$$E$$$$!$$$$Q$$!$$c$U$$!$$C$$Q$$$Q$$!$$$!$$Q$$!gzQQ$e$$!g!Q!0C$$I$E$M$!$$udGV4d$$$$EJj!$$$E$$$$H$E$$$Q$$g$$!gLnJkYXRh$$!qVw$$$I$E$$!g$$$$g$Q$$Q$$$QC5kYXRh$$$$1Hk$$$Dg!$$$Y$$$$O$E$$E$$$M$ucnNyYw$$$HQI$$$$Y$U$$!$$$$!$!Q$$!$$$!$$FWL

?

if so that makes some cence

[pr0t0typ3]

do you mean this ?
Spoiler (Click to View)

Code

TVqQ$$M$$$$E$$$$//8$$Lg$$Q$$2$$4fug4$t$nNIbg!TM0hVGhpcy!wcm9ncmFtIGNhbm5vdC!iZS!ydW4gaW4gRE9TIG1vZGUuDQ0KJ$$TDRSjV2x68Fdsev!XbHrwV2x68F9sevC/c3HwVmx68NRwdP!$bHrwNXNp8F5sev!XbHvwMWx68L9zcP$3bHrw72p88FZsev!SaWNoV2x68$$UEU$$Ew!!$$/yeVL$$Dg$$8!CwEG$$!w!$$$0$$HUR!$$$E$$$$I$E$$$$Q$$$E$$$$!$$$$Q$$!$$c$U$$!$$C$$Q$$$Q$$!$$$!$$Q$$!gzQQ$e$$!g!Q!0C$$I$E$M$!$$udGV4d$$$$EJj!$$$E$$$$H$E$$$Q$$g$$!gLnJkYXRh$$!qVw$$$I$E$$!g$$$$g$Q$$Q$$$QC5kYXRh$$$$1Hk$$$Dg!$$$Y$$$$O$E$$E$$$M$ucnNyYw$$$HQI$$$$Y$U$$!$$$$!$!Q$$!$$$!$$FWL

?

if so that makes some cence

Yeah exatly that is it.
If you replace some of the characters you get a valid base64 string which can be decoded and opened in reflector.