0

I have a .NET malware sample whose dynamic behavior I understand. It is also packed.

de4dot identified the obfuscator as .NET Reactor, so I used de4dot to de-obfuscate it. However, after de-obfuscation the sample doesn't execute.

In the de-obfuscated version:

Class8.string_0 = Strings.Split(File.ReadAllText(Process.GetCurrentProcess().MainModule.FileName), "iFiniTyDdDeTreaht", -1, CompareMethod.Binary);
Class8.byte_0 = Class8.smethod_1(Convert.FromBase64String(Class8.string_0[1]), "InfinityDeath");

As per the syntax, the first statement should read the malware sample executable, split the read text based on the delimiter iFiniTyDdDeTreaht and return an array into Class8.string_0. The second statement would then convert it into a byte array. However, I'm not sure if the string iFiniTyDdDeTreaht is correct. I feel that maybe de4dot made a mistake and the string is actually InfinityDeath. When I execute the cleaned version of the sample, string_0 does not contain anything and so, the second statement throws an IndexOutOfRangeException exception.

The obfuscated version of the same code statements:

qYXfPGwphihuIZelQj.DN53MhIle = qYXfPGwphihuIZelQj.TuDH6JKEXR0YxoMaE2(qYXfPGwphihuIZelQj.fby2Fm3YTh6gEhwRLt(qYXfPGwphihuIZelQj.owCijMmP6Z8376UMCI(qYXfPGwphihuIZelQj.dWj5s2hg9KGdD9pplN()).FileName), qYXfPGwphihuIZelQj.zNONirY3TA4fC6yCUl(64), -1, CompareMethod.Binary);
qYXfPGwphihuIZelQj.Bfw6Gc2PH = qYXfPGwphihuIZelQj.OSsRsdbSj(qYXfPGwphihuIZelQj.U9sA5R1sKhnKgEl3EZ(qYXfPGwphihuIZelQj.DN53MhIle[1]), qYXfPGwphihuIZelQj.zNONirY3TA4fC6yCUl(102));

Because the cleaned version does not work, I'm being forced to load the obfuscated version of the sample into dnSpy and I'm not able to view the values of the variables. dnSpy throws the warning - Decompiler generated variables can't be evaluated.

Does anyone have any idea how to analyze this sample? If you want to collaborate on the analysis, please DM me and I can give you more details. Thanks!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.