Meteor2142 Posted March 25, 2015 Posted March 25, 2015 Hello guys! I found a very interesting encryption code.Its using Crypted resources, decrypting it with special byte key, and execute.Here is the source of crypted file://KEY private static byte[] TSVCuLWZ = new byte[] { 0xb7, 0x61, 0xd7, 0x3d, 0x66, 0x5e, 0xa6, 0xe8, 40, 0x87, 0x19, 0x49, 0xce, 0x54, 0x68, 0x4c, 0xad, 0xa6, 0x2a, 0xf2, 160, 15, 210, 0xc6 };//Just a method to decrypt string (for more security) private static string FUJHE(string LSMFpfp, byte[] sQoPbDpAtuDXdRTcmnW) { string[] strArray = LSMFpfp.Split(new char[] { '#' }); byte[] buffer = new byte[strArray.Length]; for (int i = 0; i < strArray.Length; i++) { buffer[i] = byte.Parse(strArray[i]); } for (int j = 0; j < buffer.Length; j++) { for (int k = 0; k < sQoPbDpAtuDXdRTcmnW.Length; k++) { buffer[j] = (byte)(buffer[j] ^ sQoPbDpAtuDXdRTcmnW[k]); } } string str = ""; foreach (byte num4 in buffer) { str = str + ((char)num4); } return str; }//Main method, decryptingstatic void Main(string[] EkhHJIncZlqF) { ResourceManager resourceManager = new ResourceManager("Project.VUCusDt", Assembly.GetExecutingAssembly()); string text = ""; for (int i = 0; i < 63; i++) { text += resourceManager.GetString(FUJHE("34#8#33#53#21#57#58#20#0#34#12#20", TSVCuLWZ) + i.ToString()); } byte[] array = new byte[text.Length]; for (int j = 0; j < array.Length; j++) { array[j] = (byte)text[j]; } for (int k = 0; k < array.Length; k++) { for (int l = 0; l < TSVCuLWZ.Length; l++) { array[k] ^= TSVCuLWZ[l]; } } } //////////////With help of very nice guy we decrypted it, at all it was kinda easy. Now the question, how this method calls? It's some special soft?This way of decryption making file FUD If anyone know, write bellow! Thanks!If someone need ill send malicious file, but be careful!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now