{"id":9716,"date":"2017-10-05T09:10:39","date_gmt":"2017-10-05T17:10:39","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/10\/05\/news-3489\/"},"modified":"2017-10-05T09:10:39","modified_gmt":"2017-10-05T17:10:39","slug":"news-3489","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/10\/05\/news-3489\/","title":{"rendered":"Using ILSpy to analyze a small adware file"},"content":{"rendered":"

Credit to Author: Pieter Arntz| Date: Thu, 05 Oct 2017 16:19:25 +0000<\/strong><\/p>\n

My curiosity was triggered when the telemetry of our heuristic scanner started showing a multitude of reports about a small file called grandfather.exe<\/em>, so I went out to grab a copy and have a look at it.\"\"<\/p>\n

As you can probably tell from some of the detection names at Virustotal<\/a>, this is a MSIL (Microsoft Intermediate Language) file. There are a lot of tools to decompile MSIL executables, but ILSpy<\/a> is my personal favorite. To demonstrate why, I will show you how I analyzed this very small executable that is part of the Adware.Dotdo family.<\/p>\n

Using ILSpy<\/h3>\n

Once you have downloaded and unzipped the binaries from their site, you can run ILSpy.exe<\/em> and click File > Open<\/em> to navigate to the file that you like to look at.<\/p>\n

One advantage of ILSpy is that the code is shown in a very clear format. Even knowing how to read pseudocode<\/a> and where to find .NET documentation<\/a> will get you a long way, as I\u2019m about to demonstrate.<\/p>\n

The code in the example<\/h3>\n

\"c#<\/p>\n

Code is shown in C# format<\/em><\/p>\n

In this code slice, where the most important part of the program is initialized, we see three methods of hiding the program parts from the user:<\/p>\n