mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-30 15:05:27 +00:00
46 lines
1.5 KiB
C#
46 lines
1.5 KiB
C#
|
// Decompiled with JetBrains decompiler
|
|||
|
|
// Type: Microsoft.InfoCards.EncryptedObjectHeader
|
|||
|
|
// Assembly: infocard, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
|
|||
|
|
// MVID: ADE0A079-11DB-4A46-8BDE-D2A592CA8DEA
|
|||
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Virus.Win32.Expiro.w-67b630ead60119692b9abbdfd8717c96904ef041127c2cae033c86b718eaa61e.exe
|
|||
|
|
|
|||
|
|
using System.Runtime.InteropServices;
|
|||
|
|
|
|||
|
|
namespace Microsoft.InfoCards
|
|||
|
|
{
|
|||
|
|
[StructLayout(LayoutKind.Explicit, Size = 72)]
|
|||
|
|
internal struct EncryptedObjectHeader
|
|||
|
|
{
|
|||
|
|
public const int StructSize = 72;
|
|||
|
|
public const int IVBlockSize = 32;
|
|||
|
|
public const int IVOffset = 0;
|
|||
|
|
public const int GlobalIdOffset = 32;
|
|||
|
|
public const int LastChangeOffset = 48;
|
|||
|
|
public const int DataSizeOffset = 56;
|
|||
|
|
public const int ObjectTypeOffset = 60;
|
|||
|
|
public const int LocalIdOffset = 64;
|
|||
|
|
public const int TailPaddingOffset = 68;
|
|||
|
|
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 32)]
|
|||
|
|
[FieldOffset(0)]
|
|||
|
|
public byte IV;
|
|||
|
|
[MarshalAs(UnmanagedType.Struct)]
|
|||
|
|
[FieldOffset(32)]
|
|||
|
|
public GlobalId GlobalId;
|
|||
|
|
[MarshalAs(UnmanagedType.I8)]
|
|||
|
|
[FieldOffset(48)]
|
|||
|
|
public long LastChange;
|
|||
|
|
[MarshalAs(UnmanagedType.I4)]
|
|||
|
|
[FieldOffset(56)]
|
|||
|
|
public int DataSize;
|
|||
|
|
[MarshalAs(UnmanagedType.I4)]
|
|||
|
|
[FieldOffset(60)]
|
|||
|
|
public int ObjectType;
|
|||
|
|
[MarshalAs(UnmanagedType.I4)]
|
|||
|
|
[FieldOffset(64)]
|
|||
|
|
public int LocalId;
|
|||
|
|
[MarshalAs(UnmanagedType.I4)]
|
|||
|
|
[FieldOffset(68)]
|
|||
|
|
private int TailPadding;
|
|||
|
|
}
|
|||
|
|
}
|