
ReflectiveDLLRefresher
Reflective DLL that scans process memory and unhooks loaded libraries to evade security software, with UPX, TLS injector, and Meterpreter integration.

Reflective DLL that scans process memory and unhooks loaded libraries to evade security software, with UPX, TLS injector, and Meterpreter integration.

Execute shellcode files with rundll32

Lockbit3.0 Microsoft Defender MpClient.dll DLL Hijacking PoC

C++ DLL that performs Import Address Table hooking by parsing PE headers and redirecting imported function addresses to a custom hook inside a target…

Generates malicious DOCX documents exploiting CVE-2021-40444 (Microsoft Office RCE) with a hosted server for DLL payload delivery, based on…

Practical Windows malware development course: API hashing, DLL sideloading, shellcode execution, PE manipulation, payload hosting, and delivery labs.

phpstudy dll backdoor for v2016 and v2018

This is working POC of CVE-2022-36271

Two versions of CVE-2017-8759 exploits

PE loader with various shellcode injection techniques

A reference of Windows API function calls, including functions for file operations, process management, memory management, thread management,…

Kernel-mode Windows driver for real-time detection of process injection techniques, including shellcode, DLL, and reflective injection, with syscall…

A reference of Windows API function calls, including functions for file operations, process management, memory management, thread management,…

Full static & memory analysis of Overlord RAT: Go agent architecture, HTTP/2 + WebSocket C2, reflective DLL injection, browser keylogging, and IOCs.…

Native Delphi implementation of PE-sieve functionality with a reusable library, CLI, and PE-sieve-compatible DLL for HollowsHunter integration.

Technical analysis, writeup, and YARA rules for a DLL Sideloading campaign disguised as HWMonitor

A comprehensive PowerShell-based SharePoint security monitoring solution with CVE-2025-53770 protection, advanced DLL analysis, threat detection, and…