App Review Malware Theory - Understanding .NET Streams and Metadata

[struppigel]

Content source

https://youtu.be/RkqW5S_e8AU

Malware analysts often need to quickly determine the context of strings they see in the hex editor. Understanding of file formats greatly helps to do that. This video discusses basic .NET headers, named streams and scratches the surface of .NET metadata. It also helps in writing hunt or detection signatures.

 

[Andy Ful]

That one can be also useful:

http://www.blackstormsecurity.com/docs/ALEXANDREBORGES_DEFCON_2019.pdf