just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module SuppressIldasmAttribute? feel free to cringe at my questions. and thank you to anyone that takes the time to help. here is some of the code from dotpeek so you can see what I'm getting back.
// Decompiled with JetBrains decompiler // Type: // Assembly: rgdfgdfg, Version=1.9.2.1, Culture=neutral, PublicKeyToken=null // MVID: 59450446-F2C7-4225-B831-8B4909494F7E // Assembly location: C:\Users\ryank\Desktop\Malware_Samples\PastebinPayload\HWWKFile.exe
using System; using System.IO; using System.Reflection; using System.Runtime.InteropServices; using System.Text; using System.Threading;
internal class \u003CModule\u003E
{
private static byte[] ѢﬧѡﬦﬣﬧשׁﬨשׁѠѠѡשׁѠѣﬨѡѣѡѤﬧﬠﬣﬣѢѡѡﬤѡﬨѠѣﬥѠﬤ\uFB29ﬨﬤﬣﬡbnlVMImALUAXucSYKZSYsqgmdhsGA\u007B\u007B_\u0029V15r\u003C\u0021kLW\u003ENdX\u003C\u0024\u007D\u0022\u003C\u005Bo\u002B;
static \u003CModule\u003E.ѥﬥѡѠﬠѥﬣﬣﬥﬨﬠﬡ\uFB29ѥﬣﬢѠѢѢﬠﬦѠﬢѥѥѥﬢѤﬤﬦѤﬠﬣﬧѠ\uFB29\uFB29שׁﬡflxShkcwFFVAPdOfCzepHwOVWfaE\u002433\u0040o\u0022\u003BFv6\u002Bg\u002B6\u007C5sp9wD\u007EyC ﬣѤﬦﬢѢѢѡﬤﬣﬧﬢﬠѣﬠѢﬤﬠѠשׁѠ\uFB29ѥ\uFB29ѠﬧﬣﬢﬦﬧﬨﬣﬢﬡﬡѥﬡﬥﬤﬥﬡfQscSDUEIJNhHvHHiWXFWeKtNFvskUWP\u0027N\u0024\u003E\u003FL\u003D1\u002B_\u005E\u003Eh6XGD\u005Bg\u0026; internal static byte[] ѣﬠѤѢѠﬤשׁשׁﬡѣѢ\uFB29ﬨﬢѤשׁﬤﬣﬢѤﬡﬣ\uFB29Ѥ\uFB29ﬦѠﬤѡﬡﬡѣשׁﬢѣﬠﬢﬠﬨbssMtdECXrgBvOIKMujEzlplcZvmY\u003A\u007D\u007CSJa\u007C9\u002D12ML4IT\u005Esq5\u0021YL\u0022; internal static \u003CModule\u003E.ﬤ\uFB29\uFB29ﬦѠﬣﬣѥﬤﬨﬨѠѥﬦﬡѥѢﬦѣѢѣѣﬤ\uFB29שׁѡѣﬦﬡﬣﬧﬧѤﬥѥﬢѥﬡ\uFB29wEbxdRjWoqHCDKlqKsLbdJbFAixR\u0020s\u002A7L\u003B\u005D572l\u003F\u0029wv\u0021F\u007BMeZ\u0028\u0028Q\u0023 ﬠѠﬦﬤﬢﬦѢﬥﬨѢﬡﬠѢﬦﬧﬥﬠѢﬥѤ\uFB29ѠﬨשׁﬢѤﬢѥ\uFB29ﬧѥѤשׁﬦﬥѤﬢѣשׁWztnNkAwNHFRaniAlRkFgHLlyuvkPJ9m\u003DJW\u00254\u007E\u003Bg3d7b\u003C\u005B\u003FPKKgi\u0021; internal static Assembly ѥﬨѤﬡﬥﬡﬤﬨѢﬠѣѢѥﬤﬧѥﬡﬦѣﬧﬢﬠѠﬠѢﬡ\uFB29ѤﬥﬥﬢѢѠﬧﬠﬢѡﬢѥstBblIAkNABTObjujFJETiAegJxUA\u0026\u003Cpe\u0029f\u003FLB\u0027FKQQy\u007C\u003C\u00405nK\u007EJw\u0022; internal static \u003CModule\u003E.ﬥﬧѢѣﬥѠ\uFB29ѤﬢѢѣﬢﬧﬣשׁѠﬥﬦѠﬨ\uFB29ﬥѠﬡﬨѥﬤѠѥѢѣ\uFB29ﬢﬠﬡﬤﬢѤﬤPBUjQBqDxlPPWLlUjmxzDRkTbdIInTNA\u005CA\u0024C\u0028bx\u0021\u0025\u003E\u003FYg5BsRoU\u002D\u0024 ﬡﬣﬡ\uFB29ﬠשׁﬣѣﬧﬣѠ\uFB29ﬢﬥﬥשׁѢﬢﬤשׁﬦﬠѢѤѥѠﬡѠ\uFB29ﬣﬣѠﬧﬤ\uFB29\uFB29ﬦѥﬧyVsFZntXHrdCYJeLmjtSgBamjxOmOxe\u003A\u007DQ\u002B\u003EI\u007D\u0023\u007C6\u005DmdBW\u002F\u007DIRH\u0025;
private static GCHandle ѢﬣﬥﬢשׁѣﬠﬨﬨשׁѠﬣﬦﬣﬥﬧﬥשׁﬦѢﬤѥѥﬠﬣﬤѥﬧѤﬣﬨﬣѢﬦѡﬢשׁѤﬦnJUXgIvjdASdQQDhYLNjwiuNcIPo\u003FD\u007E6\u0025aK0\u0040jtZaBf\u002D\u007D9\u0028kNfVd( [In] uint[] obj0, [In] uint obj1) { // ISSUE: unable to decompile the method. }
[STAThread] [STAThread] private static int ѡﬥﬧѠﬨѥѤﬥﬢﬨﬦѡﬨﬣѥﬢѢﬠﬡﬥѠѣשׁﬣѠﬤﬥﬤﬥ\uFB29ѠѢﬢﬦѠﬣﬥﬥﬡISKzKEdGfUOmdKDGJGVocSUOHPLB\u005Ct\u003B\u0022Ti\u007C\u0020\u0023\u003E\u0028\u005E6\u005Cc\u007EnanE2v\u003A\u0040( [In] string[] obj0) { // ISSUE: unable to decompile the method. }
private static Assembly ѡѣﬦﬢשׁﬨﬠﬠѤѤѤѠשׁﬡ\uFB29ﬨѢﬦﬠﬢﬢﬡѥﬣשׁѡﬦﬣѥﬡѢﬢﬨﬡﬦѢﬧﬣѥzxSugbwvptbiOFZLTdkkVWBgTCTTijt\u0022\u002A5\u007Dq\u003BMJEt6p\u005DG\u003Bt\u0025I\u005C\u0040\u005E\u0025( [In] object obj0, [In] ResolveEventArgs obj1) { // ISSUE: unable to decompile the method. }
internal static byte[] ѡﬥѣﬤﬧ\uFB29ﬣﬠﬤѤѤѡﬥѡﬢﬤﬤﬠﬨﬢﬦ\uFB29ﬨﬠﬥﬠѠﬦﬣѡשׁѠﬦﬠѥѡ\uFB29ѢZyEhQghovjVWbJgGDnrmotBOZdVA2\u005Ds8\u005C\u002Aqm\u0027\u003A\u003F8ELqH\u003BKq2\u0027t\u003F\u0026( [In] byte[] obj0) { // ISSUE: unable to decompile the method. }
static \u003CModule\u003E()
{
\u003CModule\u003E.ﬢﬦﬦﬠѢ\uFB29ѣﬠѥﬢﬠﬡѠѢѥѢﬤ\uFB29ѣﬦ\uFB29ѠﬠﬠﬥﬢѡﬧﬣﬧﬣѠﬢ\uFB29\uFB29ѥѡﬥﬦSkDHyitoJRLTycHqdmhEdmaaAyLkH\u0029\u005CA1\u0020\u002F6\u007C\u003A\u003DGOS\u0020SSX7s\u003Bac\u002D\u0023();
label_1:
int num1 = -1875365012;
while (true)
{
uint num2;
switch ((num2 = (uint) (num1 ^ -271784619)) % 4U)
{
case 0:
\u003CModule\u003E.ﬦשׁﬢﬢѣѠﬦﬧﬦשׁﬢѥﬥѠѣﬨѡѤשׁﬣﬤ\uFB29Ѣﬢﬤﬡѥ\uFB29ﬦﬨﬢѡѣﬢﬤﬧﬧѥwPLLzcwMdVwcfrvCmppXFPiMoZABMx0\u0024m1D7\u002C\u0022\u0028\u002C7\u002FWgyPpsXoh9();
\u003CModule\u003E.ѢﬡﬢѡѢ\uFB29ﬨשׁѢﬨѥﬤ\uFB29ѣ\uFB29ﬦѥѥﬨﬦﬡﬨﬨѣﬨ\uFB29ﬨﬤѢѤﬤﬠѠﬨѠѠ\uFB29ѡﬡﬡApKPgUUOKblqtEevuuZlgtayWSpur\u00262q\u003Cf8\u0026\u005D\u005DFFW\u003F\u002DPgaaK\u007EOE\u0023(); \u003CModule\u003E.ﬧѣѢѥﬦﬡﬦѢﬣѡѤﬣ\uFB29ﬡѠﬢﬣ\uFB29ﬥשׁﬢѡѥﬦﬤﬡﬦѡﬧѢѠﬦﬨ\uFB29שׁѢשׁﬡﬢﬢuQPwBFIkAaoMtcDDQDtlidqOtQWjA7\u0021\u00234XKzX\u005DKI\u003FH\u003E_\u005D1e\u005BD\u0029Db\u002F();
num1 = (int) num2 * -1151438799 ^ 62872991;
continue;
case 1:
\u003CModule\u003E.ﬧﬥﬣѡﬢ\uFB29ѤѤﬧѠѤﬨѥﬧﬤѠשׁﬡѥﬦﬧﬢﬠﬣѠﬧﬣѢשׁﬠѥѣﬦﬥѤﬥѡשׁשׁtIuygSaoMqiAuyaSuniGYsAaloiw\u002C6\u005BMJAyv7x\u0021\u007BU\u003E9\u003D5\u0029\u003E\u0025Of\u003B\u005B\u002D();
num1 = (int) num2 * 1706151344 ^ 1056318149;
continue;
case 2:
goto label_3;
case 3:
goto label_1;
default:
goto label_6;
}
}
label_3:
return;
label_6:;
}
private static void ﬧѣѢѥﬦﬡﬦѢﬣѡѤﬣ\uFB29ﬡѠﬢﬣ\uFB29ﬥשׁﬢѡѥﬦﬤﬡﬦѡﬧѢѠﬦﬨ\uFB29שׁѢשׁﬡﬢﬢuQPwBFIkAaoMtcDDQDtlidqOtQWjA7\u0021\u00234XKzX\u005D`KI\u003FH\u003E_\u005D1e\u005BD\u0029Db\u002F() { // ISSUE: unable to decompile the method. }
private static void \uFB29\uFB29שׁѠﬢשׁﬠѤﬨﬤѢѤﬡѥѡѢѢﬧѠﬨשׁﬦѤﬤѣﬣﬤѢשׁﬠﬦѡѡѢﬠשׁﬦﬦ\uFB29mygDmwCKLtFLrCGPNtsYZSTckkAIb_\u0021aCoZ4b\u002C\u003C\u0028MFT\u002BQg\u0023nX\u002F\u003D9\u0023\u0027( [In] object obj0) { // ISSUE: unable to decompile the method. }
///most of the rest of the code has this //ISSUE and of course the code that is unreadable here is where i found the SuppressIldasmAttribute module
using System.Diagnostics;
using System.Reflection; using System.Runtime.CompilerServices; using System.Runtime.InteropServices; using System.Runtime.Versioning;
// Assembly rgdfgdfg, Version=1.9.2.1, Culture=neutral, PublicKeyToken=null // MVID: 59450446-F2C7-4225-B831-8B4909494F7E // Assembly references: // mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 // Module references: // kernel32.dll
[assembly: CompilationRelaxations(8)] [assembly: RuntimeCompatibility(WrapNonExceptionThrows = true)] [assembly: Debuggable(DebuggableAttribute.DebuggingModes.IgnoreSymbolStoreSequencePoints)] [assembly: AssemblyTitle("SuperSoft")] [assembly: AssemblyDescription("")] [assembly: AssemblyConfiguration("")] [assembly: AssemblyCompany("")] [assembly: AssemblyProduct("")] [assembly: AssemblyCopyright("")] [assembly: AssemblyTrademark("")] [assembly: ComVisible(true)] [assembly: AssemblyFileVersion("1.9.2.1")] [assembly: TargetFramework(".NETFramework,Version=v4.0", FrameworkDisplayName = ".NET Framework 4")] [assembly: AssemblyVersion("1.9.2.1")]
[module: SuppressIldasm]
\\thank you anyone who takes the time to help. sorry if this hurt to read.
