VBReFormer
VBReFormer - Explore our articles.
DarkCloud 4.9 Decompiled with VBReFormer Gen 2 (7.x)
A reverse engineer's reading of DarkCloud 4.9: understanding the VB6 runtime, following the data collection and telling active transports apart thanks to the code reconstructed with VBReFormer Gen 2 (7.x).
Tags:
DarkCloud, VBReFormer, VBReFormer Gen 2, Visual Basic 6, VB5, VB6, YARA, Static Analysis, Malware Configuration
Malware Research
Malware Research
25 min read
Malva.RE Decompiles VB5/VB6 with VBReFormer Gen 2
What support for Visual Basic 5/6 executables changes in a Malva.RE report: sources reconstructed with VBReFormer Gen 2 (7.x), browsable procedure by procedure, and, for DarkCloud, an exfiltration configuration read in the code rather than guessed from strings. The DarkCloud 4.9 case serves as the example.
Malware Research
Malware Research
6 min read