I've got a .NET malware sample that was transpiled to JScript using DotNet2JScript. The .NET malware assembly was serialized to binary form using BinaryFormatter and then embedded into the JScript source code. How can I transform the serialized malware assembly back to PE-file, so I can analyze it using dnSpy and similar tools? Or is there any tool that can parse metadata from serialized assemblies? Thanks!

  • I used netfleece to decode BinaryFormatter files.
    – tibar
    Sep 22, 2022 at 7:05


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.