I have a .NET malware sample whose dynamic behavior I understand. It is also packed.
de4dot identified the obfuscator as
.NET Reactor, so I used
de4dot to de-obfuscate it. However, after de-obfuscation the sample doesn't execute.
In the de-obfuscated version:
Class8.string_0 = Strings.Split(File.ReadAllText(Process.GetCurrentProcess().MainModule.FileName), "iFiniTyDdDeTreaht", -1, CompareMethod.Binary); Class8.byte_0 = Class8.smethod_1(Convert.FromBase64String(Class8.string_0), "InfinityDeath");
As per the syntax, the first statement should read the malware sample executable, split the read text based on the delimiter
iFiniTyDdDeTreaht and return an array into
Class8.string_0. The second statement would then convert it into a byte array. However, I'm not sure if the string
iFiniTyDdDeTreaht is correct. I feel that maybe
de4dot made a mistake and the string is actually
InfinityDeath. When I execute the cleaned version of the sample,
string_0 does not contain anything and so, the second statement throws an
The obfuscated version of the same code statements:
qYXfPGwphihuIZelQj.DN53MhIle = qYXfPGwphihuIZelQj.TuDH6JKEXR0YxoMaE2(qYXfPGwphihuIZelQj.fby2Fm3YTh6gEhwRLt(qYXfPGwphihuIZelQj.owCijMmP6Z8376UMCI(qYXfPGwphihuIZelQj.dWj5s2hg9KGdD9pplN()).FileName), qYXfPGwphihuIZelQj.zNONirY3TA4fC6yCUl(64), -1, CompareMethod.Binary); qYXfPGwphihuIZelQj.Bfw6Gc2PH = qYXfPGwphihuIZelQj.OSsRsdbSj(qYXfPGwphihuIZelQj.U9sA5R1sKhnKgEl3EZ(qYXfPGwphihuIZelQj.DN53MhIle), qYXfPGwphihuIZelQj.zNONirY3TA4fC6yCUl(102));
Because the cleaned version does not work, I'm being forced to load the obfuscated version of the sample into
dnSpy and I'm not able to view the values of the variables.
dnSpy throws the warning -
Decompiler generated variables can't be evaluated.
Does anyone have any idea how to analyze this sample? If you want to collaborate on the analysis, please DM me and I can give you more details. Thanks!