Rober
Me he tomado la total libertad de descargar el archivo y hacerle un análisis exhaustivo.
El archivo a descargar está ofuscado por el creador por lo que es imposible ver que tiene a simple vista. Esto es, el usuario ha intentado que nadie sea capaz de ver como está hecho o que tiene en su interior el programa.
Después de un ratico he conseguido dumpear el programa ofuscado y he conseguido acceder al código. El código a simple vista es un autoclick en toda regla, sin nada extraño.
// Decompiled with JetBrains decompiler
// Type: AutoClick.Form1
// Assembly: AutoClick, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: A9E1FA25-5CA7-4ACE-B3BF-6D1EF5242973
// Assembly location: C:\Users\Rober\Desktop\AutoClick.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace AutoClick
{
[DesignerGenerated]
public class Form1 : Form
{
private static List<WeakReference> __ENCList = new List<WeakReference>();
private IContainer components;
[AccessedThroughProperty("Timer1")]
private Timer _Timer1;
[AccessedThroughProperty("Timer2")]
private Timer _Timer2;
[AccessedThroughProperty("Timer3")]
private Timer _Timer3;
[AccessedThroughProperty("TextBox1")]
private TextBox _TextBox1;
[AccessedThroughProperty("TextBox2")]
private TextBox _TextBox2;
[AccessedThroughProperty("Label1")]
private Label _Label1;
[AccessedThroughProperty("Label2")]
private Label _Label2;
[AccessedThroughProperty("NumericUpDown1")]
private NumericUpDown _NumericUpDown1;
[AccessedThroughProperty("Button1")]
private Button _Button1;
private const int mouseclickup = 4;
private const int mouseclickdown = 2;
internal virtual Timer Timer1
{
[DebuggerNonUserCode] get
{
return this._Timer1;
}
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Timer1_Tick);
if (this._Timer1 != null)
this._Timer1.Tick -= eventHandler;
this._Timer1 = value;
if (this._Timer1 == null)
return;
this._Timer1.Tick += eventHandler;
}
}
internal virtual Timer Timer2
{
[DebuggerNonUserCode] get
{
return this._Timer2;
}
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Timer2_Tick);
if (this._Timer2 != null)
this._Timer2.Tick -= eventHandler;
this._Timer2 = value;
if (this._Timer2 == null)
return;
this._Timer2.Tick += eventHandler;
}
}
internal virtual Timer Timer3
{
[DebuggerNonUserCode] get
{
return this._Timer3;
}
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Timer3_Tick);
if (this._Timer3 != null)
this._Timer3.Tick -= eventHandler;
this._Timer3 = value;
if (this._Timer3 == null)
return;
this._Timer3.Tick += eventHandler;
}
}
internal virtual TextBox TextBox1
{
[DebuggerNonUserCode] get
{
return this._TextBox1;
}
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
this._TextBox1 = value;
}
}
internal virtual TextBox TextBox2
{
[DebuggerNonUserCode] get
{
return this._TextBox2;
}
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
this._TextBox2 = value;
}
}
internal virtual Label Label1
{
[DebuggerNonUserCode] get
{
return this._Label1;
}
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
this._Label1 = value;
}
}
internal virtual Label Label2
{
[DebuggerNonUserCode] get
{
return this._Label2;
}
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
this._Label2 = value;
}
}
internal virtual NumericUpDown NumericUpDown1
{
[DebuggerNonUserCode] get
{
return this._NumericUpDown1;
}
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
this._NumericUpDown1 = value;
}
}
internal virtual Button Button1
{
[DebuggerNonUserCode] get
{
return this._Button1;
}
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Button1_Click);
if (this._Button1 != null)
this._Button1.Click -= eventHandler;
this._Button1 = value;
if (this._Button1 == null)
return;
this._Button1.Click += eventHandler;
}
}
[DebuggerNonUserCode]
static Form1()
{
}
[DebuggerNonUserCode]
public Form1()
{
this.Load += new EventHandler(this.Form1_Load);
lock (Form1.__ENCList)
Form1.__ENCList.Add(new WeakReference((object) this));
this.InitializeComponent();
}
[DebuggerNonUserCode]
protected override void Dispose(bool disposing)
{
try
{
if ((!disposing || this.components == null) && !false)
return;
this.components.Dispose();
}
finally
{
base.Dispose(disposing);
}
}
[DebuggerStepThrough]
private void InitializeComponent()
{
this.components = (IContainer) new System.ComponentModel.Container();
this.Timer1 = new Timer(this.components);
this.Timer2 = new Timer(this.components);
this.Timer3 = new Timer(this.components);
this.TextBox1 = new TextBox();
this.TextBox2 = new TextBox();
this.Label1 = new Label();
this.Label2 = new Label();
this.NumericUpDown1 = new NumericUpDown();
this.Button1 = new Button();
this.NumericUpDown1.BeginInit();
this.SuspendLayout();
this.Timer1.Interval = 1;
this.Timer2.Enabled = true;
this.Timer2.Interval = 1;
this.Timer3.Enabled = true;
this.Timer3.Interval = 1;
TextBox textBox1_1 = this.TextBox1;
Point point1 = new Point(53, 6);
Point point2 = point1;
textBox1_1.Location = point2;
this.TextBox1.Name = "TextBox1";
TextBox textBox1_2 = this.TextBox1;
Size size1 = new Size(100, 20);
Size size2 = size1;
textBox1_2.Size = size2;
this.TextBox1.TabIndex = 0;
TextBox textBox2_1 = this.TextBox2;
point1 = new Point(53, 40);
Point point3 = point1;
textBox2_1.Location = point3;
this.TextBox2.Name = "TextBox2";
TextBox textBox2_2 = this.TextBox2;
size1 = new Size(100, 20);
Size size3 = size1;
textBox2_2.Size = size3;
this.TextBox2.TabIndex = 1;
this.Label1.AutoSize = true;
Label label1_1 = this.Label1;
point1 = new Point(12, 9);
Point point4 = point1;
label1_1.Location = point4;
this.Label1.Name = "Label1";
Label label1_2 = this.Label1;
size1 = new Size(13, 13);
Size size4 = size1;
label1_2.Size = size4;
this.Label1.TabIndex = 2;
this.Label1.Text = "0";
this.Label2.AutoSize = true;
Label label2_1 = this.Label2;
point1 = new Point(12, 43);
Point point5 = point1;
label2_1.Location = point5;
this.Label2.Name = "Label2";
Label label2_2 = this.Label2;
size1 = new Size(13, 13);
Size size5 = size1;
label2_2.Size = size5;
this.Label2.TabIndex = 3;
this.Label2.Text = "0";
NumericUpDown numericUpDown1_1 = this.NumericUpDown1;
point1 = new Point(15, 79);
Point point6 = point1;
numericUpDown1_1.Location = point6;
NumericUpDown numericUpDown1_2 = this.NumericUpDown1;
Decimal num1 = new Decimal(new int[4]{ 500, 0, 0, 0 });
Decimal num2 = num1;
numericUpDown1_2.Maximum = num2;
NumericUpDown numericUpDown1_3 = this.NumericUpDown1;
num1 = new Decimal(new int[4]{ 1, 0, 0, 0 });
Decimal num3 = num1;
numericUpDown1_3.Minimum = num3;
this.NumericUpDown1.Name = "NumericUpDown1";
NumericUpDown numericUpDown1_4 = this.NumericUpDown1;
size1 = new Size(138, 20);
Size size6 = size1;
numericUpDown1_4.Size = size6;
this.NumericUpDown1.TabIndex = 4;
NumericUpDown numericUpDown1_5 = this.NumericUpDown1;
num1 = new Decimal(new int[4]{ 203, 0, 0, 0 });
Decimal num4 = num1;
numericUpDown1_5.Value = num4;
Button button1_1 = this.Button1;
point1 = new Point(15, 105);
Point point7 = point1;
button1_1.Location = point7;
this.Button1.Name = "Button1";
Button button1_2 = this.Button1;
size1 = new Size(138, 23);
Size size7 = size1;
button1_2.Size = size7;
this.Button1.TabIndex = 5;
this.Button1.Text = "Instrucciones";
this.Button1.UseVisualStyleBackColor = true;
this.AutoScaleDimensions = new SizeF(6f, 13f);
this.AutoScaleMode = AutoScaleMode.Font;
this.BackColor = Color.FromArgb((int) byte.MaxValue, 192, 128);
size1 = new Size(164, 136);
this.ClientSize = size1;
this.Controls.Add((Control) this.Button1);
this.Controls.Add((Control) this.NumericUpDown1);
this.Controls.Add((Control) this.Label2);
this.Controls.Add((Control) this.Label1);
this.Controls.Add((Control) this.TextBox2);
this.Controls.Add((Control) this.TextBox1);
this.FormBorderStyle = FormBorderStyle.FixedToolWindow;
this.MaximizeBox = false;
this.MinimizeBox = false;
this.Name = "Form1";
this.StartPosition = FormStartPosition.CenterScreen;
this.Text = "AutoClick";
this.NumericUpDown1.EndInit();
this.ResumeLayout(false);
this.PerformLayout();
}
[DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern void mouse_event(long dwflags, long dx, long dy, long cbuttons, long dwExtraInfo);
[DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int GetAsyncKeyState(long vkey);
private void Form1_Load(object sender, EventArgs e)
{
}
private void Timer1_Tick(object sender, EventArgs e)
{
Cursor.Position = new Point(Cursor.Position.X, Cursor.Position.Y);
this.Timer1.Interval = Convert.ToInt32(this.NumericUpDown1.Value);
this.Label1.Text = Conversions.ToString(Cursor.Position.X);
Label label2 = this.Label2;
Point point = Cursor.Position;
string @string = Conversions.ToString(point.Y);
label2.Text = @string;
point = new Point(Conversions.ToInteger(this.TextBox1.Text), Conversions.ToInteger(this.TextBox2.Text));
Cursor.Position = point;
Form1.mouse_event(2L, 0L, 0L, 0L, 0L);
Form1.mouse_event(4L, 0L, 0L, 0L, 0L);
point = new Point(Conversions.ToInteger(this.Label1.Text), Conversions.ToInteger(this.Label2.Text));
Cursor.Position = point;
}
private void Timer2_Tick(object sender, EventArgs e)
{
if ((uint) Form1.GetAsyncKeyState(112L) > 0U)
this.Timer1.Start();
if ((uint) Form1.GetAsyncKeyState(113L) <= 0U)
return;
this.Timer1.Stop();
}
private void Timer3_Tick(object sender, EventArgs e)
{
bool flag = (uint) Form1.GetAsyncKeyState(120L) > 0U;
if (flag)
{
this.TextBox1.Text = Conversions.ToString(Control.MousePosition.X);
this.TextBox2.Text = Conversions.ToString(Control.MousePosition.Y);
}
if (!flag)
;
}
private void TrackBar1_Scroll(object sender, EventArgs e)
{
}
private void Button1_Click(object sender, EventArgs e)
{
int num = (int) Interaction.MsgBox((object) " Activar F1 Desactivar F2 SetPoint F9 ", MsgBoxStyle.OkOnly, (object) null);
}
}
}
Reviso las conexiones que hace el archivo y me encuentro con que conecta con un extraño servidor.
Proto Dirección local Dirección remota Estado
TCP 192.168.199.128:1349 24.141.65.87:2525 SYN_SENT
En conclusión, el archivo extraído es un autoclick aunque no deja de ser sospechoso ya que conecta con un servidor que podría ser donde envíe la información en caso de ser un virus y por el deseo del creador de que no veamos qué tiene dentro, aclaro también que puede haber más archivos dentro del ejecutable aunque yo solo haya conseguido sacar ese y recuerdo que no nos hacemos responsables de lo que descarguéis ni de que os dejéis hackear.
