Malware Theory - Understanding .NET Streams and Metadata
Channel: MalwareAnalysisForHedgehogs
Date: 2021-04-01

Malware analysts often need to quickly determine the context of strings they see in the hex editor. Understanding of file formats greatly helps to do that. This video discusses basic .NET headers, named streams and scratches the surface of .NET metadata. Afterwards you will be able to recognize the .NET metadata header and streams in a hex editor and understand the contents when exploring them in tools like CFF Explorer.

My malware analysis course for beginners: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?referralCode=EE0E2DC9FA7388FF25B7
Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

CFF Explorer: https://ntcore.com/?page_id=388
HxD: https://mh-nexus.de/en/hxd/