0

I'm analysing a .Net executable and de4dot doesn't detect its obfuscator. Class/Method/Property names start with #=. Does anybody know what obfuscator this is?

// Token: 0x0600EE8B RID: 61067 RVA: 0x005FD1D0 File Offset: 0x005FB3D0
private static void #=zYty0Ku8H9q$P(string #=zndQNTVv$9cLKMhwNUA==)
{
    object[] array = new object[] { #=zndQNTVv$9cLKMhwNUA== };
    #=zJUlsCmxPFKvbh0EyDbcW8B0CcRW$RAie2y9$FflzHIPGQDaemg==.#=z6Kgg5g$lVS73p5E8js4ejGWKF9p9S1pkoyFDU456Zy7P4uBwAw==().#=zTHv$7gizw9KfR6H2XIF19QgccLki(#=zJUlsCmxPFKvbh0EyDbcW8B0CcRW$RAie2y9$FflzHIPGQDaemg==.#=z2vAU$2yunFLLek5WBUt1VZpwwpO21O3R5mIYq4yVvMu5NZwZzQ==(), "qYP%'\"TSDu", array);
}

enter image description here

enter image description here

3
  • Did you check with PEiD? or Yara? Also I think you can load other signatures on DiE (the one you are using)
    – Allinone
    Commented Feb 7 at 15:02
  • 2
    please do not post pictures of text ... post the text instead ... format as code ... use the edit button to update your post
    – jsotola
    Commented Feb 7 at 20:58
  • @jsotola Updated my question with a code sample
    – Gudarzi
    Commented Feb 8 at 10:56

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.