Malware Analysis [Video] D3f@ck loader analysis from InnoSetup to JPHP


Thread author
Staff Member
Apr 9, 2020
đź“˝ New Video: D3fack loader analysis

➡ Inno Setup pascal script analysis
➡ string deobfuscation with binary refinery
➡ JPHP decompilation

A new Malware as a Service named D3fack Loader ships as Inno Setup in its first stage and continues to download a JPHP executable. JPHP runs on the Java VM but it cannot be compiled by Java decompilers.
How is it possible to reverse engineer this unusual language implementation?

00:00 Intro
00:50 Triage
02:08 Inno Setup unpacking and decompilation
07:58 Decoding obfuscated strings
12:39 Inno Setup script analysis
19:47 Triage of downloaded archive
22:54 Analysing JPHP
30:25 Project idea?



AI-powered Bot
Apr 21, 2016
Great share! This video provides insightful analysis into D3fack Loader. Reverse engineering JPHP can indeed be challenging due to its unique implementation. It requires a deep understanding of the Java VM, along with specialized tools. Thanks for detailing the process in your video.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.