Funny coded malware

Rate this Entry
Some days ago I had the opportunity to check one of the last msn malware. I think thereís often something interesting inside a malware, no matter what it does and this is a perfect example!

The malware is able to infect only right handed people! Iím not kidding...
Among all the windows settings thereís one made for left handed people. The option Iím referring to is located under the Mouse control panel, labelled ďSwitch primary and secondary buttonsĒ. It lets you exchange the functions performed by the right and left mouse button. Donít know if this setting is usefull or not, most of the left handed friends I have are still using the mouse like a right handed. Maybe they donít even know the existence of such an option. Anyway, look at this code:

Itís a simple query on a registry key named SwapMouseButtons.
result_value is sent back to the caller, and the caller checks the value. If the value is equal to 0◊30 (right handed) the malware goes on running the rest of the code, but if the value is 0◊31 (left handed) the malware ends immediately. All the nasty things performed by the malware are executed after this check, it means that a left handed wonít get infected!

Iíve seen some malwares using SwapMouseButton function in the past, but never something like that. I bet the author is left handed and he wrote the check just to be sure to avoid a possible infectionÖ I canít think of anything else. Quite funny!!!

The malware is not really interesting per se, but it has something Iíve never noticed before. Itís not a cool and dangerous new technique, but a coding behaviour. Look at the graph overview:

The image represents the content of a malware procedure. Nothing strange per se, except the fact that it contains 657 instructions in it, too many for a simple malware. Itís a big routine and I was surprised at first because you can do a lot of things with so many instructions. I started analysing the code, nothing is passed to the routine and nothing is returned back to the original caller. I tought it should be an important part of the malware, but I was disappointed by the real content of the routine. After few seconds I realized whatís really going on: 657 lines of code for doing something that normally would require around 50 linesÖ
The function contains a block of 17 instructions repeated 38 times. When Iím facing things like that I always have a little discussion with my brain. The questions are:
- why do you need to repeat each block 38 times?
- canít you just use a while statement?
- is this a sort of anti-disassembling trick?
- can you produce such a procedure setting up some specific compilerís options?

The repeated block contains the instruction below:
00402175    push 9                       ; Length of the string to decrypt
00402177    push offset ntdll_dll        ; String to decrypt
0040217C    push offset aM4l0x123456789  ; key: "M4L0X123456789"
00402181    call sub_401050              ; decrypt "ntdll.dll"
00402186    add  esp, 0Ch
00402189    mov  edi, eax
0040218B    mov  edx, offset ntdll_dll
00402190    or   ecx, 0FFFFFFFFh
00402193    xor  eax, eax
00402195    repne scasb
00402197    not  ecx
00402199    sub  edi, ecx
0040219B    mov  esi, edi
0040219D    mov  eax, ecx
0040219F    mov  edi, edx
004021A1    shr  ecx, 2
004021A4    rep movsd
004021A6    mov  ecx, eax
004021A8    and  ecx, 3
004021AB    rep movsb
Itís only a decryption routine, nothing more. The string is decrypted by the ďcall 401050″, the rest of the code simply moves the string in the right buffer.
Ok, letís try answering the initial questions.

According to some PE scanners the exe file was produced by Microsoft Visual C++ 6.0 SPx.
Itís possible to code the big procedure just using a loop (while, for, do-while) containing the snippet above. I donít think the author used one of these statements because as far as I know itís not possible to tell the compiler to explode a cycle into a sequence of blocks. At this point I have to options:
- he wrote the same block for 38 times
- he defined a macro with the blockís instructions repeating the macro for 38 times
I wonít code something like that, but the macro option seems to be the most probable choice.
Is it an anti-disassembling trick? My answer is no because itís really easy to read such a code. You donít have to deal with variables used inside a for/while; to understand whatís going on you only have to compare three or four blocks.
I donít have a valid answer to the doubt I had at firstÖ.

Trying to find out some more info I studied the rest of the code. I was quite surprised to see another funny diagram.

This time the image represents the content of the procedure used to retrieve the address of the API functions. Again, no while/for/do-while statement. The rectangle on the upper part of the image itís a sequence of calls to GetProcAddress, and the code below itís just a sequence of checks on the addresses obtained by GetProcAddress.
Itís a series of:

address = GetProcAddress(hDLL, "function_name");

followed by a series of:

if (!address) goto _error;

Apart the non-use of a loop thereís something more this time, something that I think reveals an unusual coding style; tha author checks errors at the end of the procedure. I always prefer to check return values as soon as I can, itís not a rule but itís something that help you to avoid oversight and potential errorsÖ The procedure has a little bug/oversight at the end, the author forgot to close an opened handle. Just a coincidence?
Anyway, two procedures without a single loop. Seems like the author didnít use any kind of loop for choice. In case you still have some doubts hereís another cool pictures for you:

The routine inside the picture contains the code used to check if the API(s) are patched or not. The check is done comparing the first byte with 0xE8 and 0xE9 (call and jump). If the functions are not patched the malware goes on, otherwise it ends. As you can see no loops are used.

In summary: itís not jungle code, itís not an anti-disasm code and itís not a specific compiler setting. I think itís only a personal choice, but I would really like to know why the author used this particular style.
Do you have any suggestions?

Beyond the coding style, the malware has some more strange things. As pointed out by *asaperlo*, the code contains a bugged RC4 implementation.
It also has a virtual machine check. The idea is pretty simple, the malware checks the nick of the current user. If the nick is ďsandboxĒ or ďvmwareĒ you are under a virtual machineÖ
This malware spawns another one (itís encrypted inside the file), it might be material for another post.

Thatís a funny coded malware for sure!

Submit "Funny coded malware" to Digg Submit "Funny coded malware" to Submit "Funny coded malware" to StumbleUpon Submit "Funny coded malware" to Google