mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2025-01-30 22:15:07 +00:00
343 lines
7.2 KiB
C#
343 lines
7.2 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
// Type: .
|
|||
|
// Assembly: CSPharm, Version=1.0.0.0, Culture=neutral, PublicKeyToken=91f7ba0f4234404d
|
|||
|
// MVID: E3EED34E-DEA0-448A-9147-166831419ACC
|
|||
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Downloader.Win32.Dapato.lnd-7f2f48002f973886553b938cc98149108eb2e39f2ac47324d3c731a4208c60fd.exe
|
|||
|
|
|||
|
using \u0003;
|
|||
|
using System;
|
|||
|
using System.IO;
|
|||
|
using System.Runtime.CompilerServices;
|
|||
|
using System.Runtime.InteropServices;
|
|||
|
|
|||
|
namespace \u0005
|
|||
|
{
|
|||
|
internal sealed class \u0003
|
|||
|
{
|
|||
|
internal sealed class \u0001
|
|||
|
{
|
|||
|
internal static readonly int[] \u0001 = new int[29]
|
|||
|
{
|
|||
|
3,
|
|||
|
4,
|
|||
|
5,
|
|||
|
6,
|
|||
|
7,
|
|||
|
8,
|
|||
|
9,
|
|||
|
10,
|
|||
|
11,
|
|||
|
13,
|
|||
|
15,
|
|||
|
17,
|
|||
|
19,
|
|||
|
23,
|
|||
|
27,
|
|||
|
31,
|
|||
|
35,
|
|||
|
43,
|
|||
|
51,
|
|||
|
59,
|
|||
|
67,
|
|||
|
83,
|
|||
|
99,
|
|||
|
115,
|
|||
|
131,
|
|||
|
163,
|
|||
|
195,
|
|||
|
227,
|
|||
|
258
|
|||
|
};
|
|||
|
internal static readonly int[] \u0002 = new int[29]
|
|||
|
{
|
|||
|
0,
|
|||
|
0,
|
|||
|
0,
|
|||
|
0,
|
|||
|
0,
|
|||
|
0,
|
|||
|
0,
|
|||
|
0,
|
|||
|
1,
|
|||
|
1,
|
|||
|
1,
|
|||
|
1,
|
|||
|
2,
|
|||
|
2,
|
|||
|
2,
|
|||
|
2,
|
|||
|
3,
|
|||
|
3,
|
|||
|
3,
|
|||
|
3,
|
|||
|
4,
|
|||
|
4,
|
|||
|
4,
|
|||
|
4,
|
|||
|
5,
|
|||
|
5,
|
|||
|
5,
|
|||
|
5,
|
|||
|
0
|
|||
|
};
|
|||
|
internal static readonly int[] \u0003 = new int[30]
|
|||
|
{
|
|||
|
1,
|
|||
|
2,
|
|||
|
3,
|
|||
|
4,
|
|||
|
5,
|
|||
|
7,
|
|||
|
9,
|
|||
|
13,
|
|||
|
17,
|
|||
|
25,
|
|||
|
33,
|
|||
|
49,
|
|||
|
65,
|
|||
|
97,
|
|||
|
129,
|
|||
|
193,
|
|||
|
257,
|
|||
|
385,
|
|||
|
513,
|
|||
|
769,
|
|||
|
1025,
|
|||
|
1537,
|
|||
|
2049,
|
|||
|
3073,
|
|||
|
4097,
|
|||
|
6145,
|
|||
|
8193,
|
|||
|
12289,
|
|||
|
16385,
|
|||
|
24577
|
|||
|
};
|
|||
|
internal static readonly int[] \u0004 = new int[30]
|
|||
|
{
|
|||
|
0,
|
|||
|
0,
|
|||
|
0,
|
|||
|
0,
|
|||
|
1,
|
|||
|
1,
|
|||
|
2,
|
|||
|
2,
|
|||
|
3,
|
|||
|
3,
|
|||
|
4,
|
|||
|
4,
|
|||
|
5,
|
|||
|
5,
|
|||
|
6,
|
|||
|
6,
|
|||
|
7,
|
|||
|
7,
|
|||
|
8,
|
|||
|
8,
|
|||
|
9,
|
|||
|
9,
|
|||
|
10,
|
|||
|
10,
|
|||
|
11,
|
|||
|
11,
|
|||
|
12,
|
|||
|
12,
|
|||
|
13,
|
|||
|
13
|
|||
|
};
|
|||
|
internal int \u0005;
|
|||
|
internal int \u0006;
|
|||
|
internal int \u0007;
|
|||
|
internal int \u0008;
|
|||
|
internal int \u000E;
|
|||
|
internal bool \u000F;
|
|||
|
internal \u0005.\u0003.\u0002 \u0010;
|
|||
|
internal \u0005.\u0003.\u0003 \u0011;
|
|||
|
internal \u0005.\u0003.\u0005 \u0012;
|
|||
|
internal \u0005.\u0003.\u0004 \u0013;
|
|||
|
internal \u0005.\u0003.\u0004 \u0014;
|
|||
|
|
|||
|
public \u0001([In] byte[] obj0)
|
|||
|
{
|
|||
|
this.\u0010 = new \u0005.\u0003.\u0002();
|
|||
|
this.\u0011 = new \u0005.\u0003.\u0003();
|
|||
|
this.\u0005 = 2;
|
|||
|
\u0001.\u0001(obj0.Length, 0, obj0, this.\u0010);
|
|||
|
}
|
|||
|
}
|
|||
|
|
|||
|
internal sealed class \u0002
|
|||
|
{
|
|||
|
internal byte[] \u0001;
|
|||
|
internal int \u0002 = 0;
|
|||
|
internal int \u0003 = 0;
|
|||
|
internal uint \u0004 = 0;
|
|||
|
internal int \u0005 = 0;
|
|||
|
}
|
|||
|
|
|||
|
internal sealed class \u0003
|
|||
|
{
|
|||
|
internal byte[] \u0001 = new byte[32768];
|
|||
|
internal int \u0002 = 0;
|
|||
|
internal int \u0003 = 0;
|
|||
|
}
|
|||
|
|
|||
|
internal sealed class \u0004
|
|||
|
{
|
|||
|
internal short[] \u0001;
|
|||
|
public static readonly \u0005.\u0003.\u0004 \u0002;
|
|||
|
public static readonly \u0005.\u0003.\u0004 \u0003;
|
|||
|
|
|||
|
static \u0004()
|
|||
|
{
|
|||
|
byte[] numArray1 = new byte[288];
|
|||
|
int num1 = 0;
|
|||
|
while (num1 < 144)
|
|||
|
numArray1[num1++] = (byte) 8;
|
|||
|
while (num1 < 256)
|
|||
|
numArray1[num1++] = (byte) 9;
|
|||
|
while (num1 < 280)
|
|||
|
numArray1[num1++] = (byte) 7;
|
|||
|
while (num1 < 288)
|
|||
|
numArray1[num1++] = (byte) 8;
|
|||
|
\u0005.\u0003.\u0004.\u0002 = new \u0005.\u0003.\u0004(numArray1);
|
|||
|
byte[] numArray2 = new byte[32];
|
|||
|
int num2 = 0;
|
|||
|
while (num2 < 32)
|
|||
|
numArray2[num2++] = (byte) 5;
|
|||
|
\u0005.\u0003.\u0004.\u0003 = new \u0005.\u0003.\u0004(numArray2);
|
|||
|
}
|
|||
|
|
|||
|
public \u0004([In] byte[] obj0) => \u0001.\u0001(obj0, this);
|
|||
|
}
|
|||
|
|
|||
|
internal sealed class \u0005
|
|||
|
{
|
|||
|
internal static readonly int[] \u0001 = new int[3]
|
|||
|
{
|
|||
|
3,
|
|||
|
3,
|
|||
|
11
|
|||
|
};
|
|||
|
internal static readonly int[] \u0002 = new int[3]
|
|||
|
{
|
|||
|
2,
|
|||
|
3,
|
|||
|
7
|
|||
|
};
|
|||
|
internal byte[] \u0003;
|
|||
|
internal byte[] \u0004;
|
|||
|
internal \u0005.\u0003.\u0004 \u0005;
|
|||
|
internal int \u0006;
|
|||
|
internal int \u0007;
|
|||
|
internal int \u0008;
|
|||
|
internal int \u000E;
|
|||
|
internal int \u000F;
|
|||
|
internal int \u0010;
|
|||
|
internal byte \u0011;
|
|||
|
internal int \u0012;
|
|||
|
internal static readonly int[] \u0013;
|
|||
|
|
|||
|
static \u0005()
|
|||
|
{
|
|||
|
int[] numArray = new int[19];
|
|||
|
// ISSUE: field reference
|
|||
|
RuntimeFieldHandle fldHandle = __fieldref (\u0002.\u0002.\u0010);
|
|||
|
if (true)
|
|||
|
goto label_2;
|
|||
|
label_1:
|
|||
|
\u0005.\u0003.\u0005.\u0013 = numArray;
|
|||
|
return;
|
|||
|
label_2:
|
|||
|
RuntimeHelpers.InitializeArray((Array) numArray, fldHandle);
|
|||
|
goto label_1;
|
|||
|
}
|
|||
|
}
|
|||
|
|
|||
|
internal sealed class \u0006
|
|||
|
{
|
|||
|
private static readonly int[] \u0001 = new int[19]
|
|||
|
{
|
|||
|
16,
|
|||
|
17,
|
|||
|
18,
|
|||
|
0,
|
|||
|
8,
|
|||
|
7,
|
|||
|
9,
|
|||
|
6,
|
|||
|
10,
|
|||
|
5,
|
|||
|
11,
|
|||
|
4,
|
|||
|
12,
|
|||
|
3,
|
|||
|
13,
|
|||
|
2,
|
|||
|
14,
|
|||
|
1,
|
|||
|
15
|
|||
|
};
|
|||
|
internal static readonly byte[] \u0002 = new byte[16]
|
|||
|
{
|
|||
|
(byte) 0,
|
|||
|
(byte) 8,
|
|||
|
(byte) 4,
|
|||
|
(byte) 12,
|
|||
|
(byte) 2,
|
|||
|
(byte) 10,
|
|||
|
(byte) 6,
|
|||
|
(byte) 14,
|
|||
|
(byte) 1,
|
|||
|
(byte) 9,
|
|||
|
(byte) 5,
|
|||
|
(byte) 13,
|
|||
|
(byte) 3,
|
|||
|
(byte) 11,
|
|||
|
(byte) 7,
|
|||
|
(byte) 15
|
|||
|
};
|
|||
|
private static readonly short[] \u0003 = new short[286];
|
|||
|
private static readonly byte[] \u0004 = new byte[286];
|
|||
|
private static readonly short[] \u0005;
|
|||
|
private static readonly byte[] \u0006;
|
|||
|
|
|||
|
static \u0006()
|
|||
|
{
|
|||
|
if (true)
|
|||
|
goto label_13;
|
|||
|
label_2:
|
|||
|
int index1;
|
|||
|
for (; index1 < 144; \u0005.\u0003.\u0006.\u0004[index1++] = (byte) 8)
|
|||
|
\u0005.\u0003.\u0006.\u0003[index1] = \u0001.\u0001(48 + index1 << 8);
|
|||
|
for (; index1 < 256; \u0005.\u0003.\u0006.\u0004[index1++] = (byte) 9)
|
|||
|
\u0005.\u0003.\u0006.\u0003[index1] = \u0001.\u0001(256 + index1 << 7);
|
|||
|
for (; index1 < 280; \u0005.\u0003.\u0006.\u0004[index1++] = (byte) 7)
|
|||
|
\u0005.\u0003.\u0006.\u0003[index1] = \u0001.\u0001(index1 - 256 << 9);
|
|||
|
for (; index1 < 286; \u0005.\u0003.\u0006.\u0004[index1++] = (byte) 8)
|
|||
|
\u0005.\u0003.\u0006.\u0003[index1] = \u0001.\u0001(index1 - 88 << 8);
|
|||
|
\u0005.\u0003.\u0006.\u0005 = new short[30];
|
|||
|
\u0005.\u0003.\u0006.\u0006 = new byte[30];
|
|||
|
for (int index2 = 0; index2 < 30; ++index2)
|
|||
|
{
|
|||
|
\u0005.\u0003.\u0006.\u0005[index2] = \u0001.\u0001(index2 << 11);
|
|||
|
\u0005.\u0003.\u0006.\u0006[index2] = (byte) 5;
|
|||
|
}
|
|||
|
return;
|
|||
|
label_13:
|
|||
|
index1 = 0;
|
|||
|
goto label_2;
|
|||
|
}
|
|||
|
}
|
|||
|
|
|||
|
internal sealed class \u0007 : MemoryStream
|
|||
|
{
|
|||
|
public \u0007([In] byte[] obj0)
|
|||
|
: base(obj0, false)
|
|||
|
{
|
|||
|
}
|
|||
|
}
|
|||
|
}
|
|||
|
}
|