In a CIL assembly, where are resources stored?
I am trying to reverse engineer a sample that appears to be protected by a .NET crypter.
The CIL assembly for the sample does a SHA256 decryption on a blob that is retrieved using System.Resources.ResourceManager::GetObject, but I am unsure where in the binary those resources are. I loaded the binary into Resource Hacker, but all it can see is something called Version Info that has metadata about the binary in it. I'm assuming there's some kind of segment or something that isn't an actual PE segment, but is a CLI segment?
For reference, it is on malwr.com, MD5: 891905810486c6dee6d246f9845fb5cd
Any help appreciated.