{"id":4649,"date":"2023-12-18T15:07:06","date_gmt":"2023-12-18T23:07:06","guid":{"rendered":"https:\/\/www.pnfsoftware.com\/blog\/?p=4649"},"modified":"2024-01-05T15:24:49","modified_gmt":"2024-01-05T23:24:49","slug":"how-to-use-jeb-to-analyze-an-obfuscated-win32-crypto-clipper","status":"publish","type":"post","link":"https:\/\/www.pnfsoftware.com\/blog\/how-to-use-jeb-to-analyze-an-obfuscated-win32-crypto-clipper\/","title":{"rendered":"How To Use JEB – Analyze an obfuscated win32 crypto clipper"},"content":{"rendered":"\n

We’re kicking off a malware analysis series explaining how to use JEB Decompiler to perform reverse engineering tasks ranging from out-of-the-box actions to complex use cases requiring scripts or custom plugins.<\/em><\/p>\n\n\n\n

In this first entry, we look at a Windows malware compiled for x86 32-bit targets. The malware is an Ethereum cryptocurrency stealer. It monitors and intercepts clipboard activity to find and replace wallet addresses by an address of its own — presumably, one controlled by the malware authors to collect stolen ether.<\/p>\n\n\n\n

\n

Table of Contents<\/p>\n