---
title: "Discussion on \"Malware Write-up: Analyzing a PDF-Disguised Multi-Stage .NET Loader\" | Hashnode"
description: "Discussion on \"Malware Write-up: Analyzing a PDF-Disguised Multi-Stage .NET Loader\". Disclaimer: This post describes malware analysis in an isolated lab. Do not run samples on a daily-use machine. Hashes and IOCs are shared for research and defense.\n\nIntroduction\nI am an IT profession"
url: "https://hashnode.com/posts/malware-write-up-analyzing-a-pdf-disguised-multi-stage-net-loader/6a9defa05620cf1dfe54819c"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Malware Write-up: Analyzing a PDF-Disguised Multi-Stage .NET Loader](https://kernelzera.hashnode.dev/malware-write-up-analyzing-a-pdf-disguised-multi-stage-net-loader?utm_source=hashnode&utm_medium=feed)

Disclaimer: This post describes malware analysis in an isolated lab. Do not run samples on a daily-use machine. Hashes and IOCs are shared for research and defense. Introduction I am an IT profession

Sep 6 · 9 min read · kernelzera.hashnode.dev  
Read the article

-   [#reverse-engineering](https://hashnode.com/tag/reverse-engineering)
-   [#malware-analysis](https://hashnode.com/tag/malware-analysis)
-   [#low-level-programming](https://hashnode.com/tag/low-level-programming)
-   [#hacking](https://hashnode.com/tag/hacking)

## Written by

[Kernelzera](https://hashnode.com/@kernelzera)

@kernelzera · São Paulo, Brazil

  
[View profile](https://hashnode.com/@kernelzera)

Sharing my adventures in reverse engineering

## Responses 1

Markdown supported · ⌘↵ to post

[Furqan Ashraf](https://hashnode.com/@jfreaks)

[Nov 2](https://hashnode.com/posts/malware-write-up-analyzing-a-pdf-disguised-multi-stage-net-loader/6a9defa05620cf1dfe54819c/comment/6ae83265628ed693063ebc37)

Thorough write-up. One quick check that would sort your 16 candidates: registration date. Freshly registered names are more likely attacker-owned, while older sites are more likely compromised and used as relays. That also changes who you report to: the registrar for the first, the site owner for the second.

WHOIS gives you creation dates for most of them. For a list this size, the [WhoisFreaks WHOIS API](https://whoisfreaks.com/documentation/whois-api) does RDAP and port 43 behind one JSON, with 500 free credits (disclosure: I work there).