Patient number one
very dangerous and invincible malware yes
http://www.virustotal.com/file-scan/rep ... 1318083179
this is actually small test written by me few years ago, especially for avira paranoid.
and this is the same file, recompiled
http://www.virustotal.com/file-scan/rep ... 1318126219
hash calculators failed, perfectly reveals fakeav by the way.
and here is actual source code of this "Trojan Downloader Codec Pack"
very dangerous and invincible malware yes
http://www.virustotal.com/file-scan/rep ... 1318083179
this is actually small test written by me few years ago, especially for avira paranoid.
and this is the same file, recompiled
http://www.virustotal.com/file-scan/rep ... 1318126219
hash calculators failed, perfectly reveals fakeav by the way.
and here is actual source code of this "Trojan Downloader Codec Pack"
Code: Select all
{$E EXE}
{$IMAGEBASE $00400000}
{$R-}
{$Q-}
{$IFDEF minimum}
program Heur;
{$ENDIF}
unit Heur;
interface
uses
Windows, WinNative;
implementation
var
hModule1: DWORD;
p1: pointer;
st1: UNICODE_STRING;
ns: NTSTATUS;
begin
RtlInitUnicodeString(@st1, kernel32);
ns := LdrLoadDll(nil, nil, @st1, @hModule1);
if (ns = STATUS_SUCCESS) then
begin
p1 := nil;
RtlInitAnsiString(@st1, 'Beep');
ns := LdrGetProcedureAddress(hModule1, @st1, 0, @p1);
if (ns = STATUS_SUCCESS) then
asm
push 10
push 2000
call p1
end;
LdrUnloadDll(hModule1);
end;
end.Ring0 - the source of inspiration
