Sample
Analysis
Goal
Decompile the main malware code and figure out where it downloads the next stage. If the download URL is not available anymore, the deaddrop URL will suffice.
This ZIP archive is downloaded by this InnoSetup sample. You may want to start analyzing there.
Description
This is a JPHP sample, it runs on the JVM. With some tweaks you can decompile the JPHP code with standard Java bytecode decompilers.
Recommended Tools
recaf
Image
Comments
Please login to view and post comments.