,, MMP""MM""YMM `7MM P' MM `7 MM MM MMpMMMb. .gP"Ya MM MM MM ,M' Yb MM MM MM 8M"""""" MM MM MM YM. , .JMML. .JMML JMML.`Mbmmd' `7MMF' `7MF' `7MMF' `7MMF' `MA ,V MM MM VM: ,V `7M' `MF' MM MM .gP"Ya ,6"Yb.`7M' `MF'.gP"Ya `7MMpMMMb. MM. M' `VA ,V' MMmmmmmmMM ,M' Yb 8) MM VA ,V ,M' Yb MM MM `MM A' XMX MM MM 8M"""""" ,pm9MM VA ,V 8M"""""" MM MM :MM; ,V' VA. MM MM YM. , 8M MM VVV YM. , MM MM VF .AM. .MA..JMML. .JMML.`Mbmmd' `Moo9^Yo. W `Mbmmd'.JMML JMML. ,, ,, ,, .g8"""bgd `7MM `7MM mm db .dP' `M MM MM MM dM' ` ,pW"Wq. MM MM .gP"Ya ,p6"bo mmMMmm `7MM ,pW"Wq.`7MMpMMMb. MM 6W' `Wb MM MM ,M' Yb 6M' OO MM MM 6W' `Wb MM MM MM. 8M M8 MM MM 8M"""""" 8M MM MM 8M M8 MM MM `Mb. ,'YA. ,A9 MM MM YM. , YM. , MM MM YA. ,A9 MM MM `"bmmmd' `Ybmd9'.JMML..JMML.`Mbmmd' YMbmd' `Mbmo.JMML.`Ybmd9'.JMML JMML. -- Contact -- https://twitter.com/vxunderground email@example.com
I got this idea from the Virus Bulletin article about the Microsoft Script Encoder. (www.virusbtn.com/virusbulletin/archive/2006/01/vb200601/pdf) That article mentions the EncodeScriptFile method that no-one noticed before, so I looked at it, to see what it could do. Amazingly, it can be used to encode any string that is passed to it. It is even documented on Microsoft's website!
The EncodeScriptFile function is a method of the "Scripting.Encoder" object. To use it, just do this:
Then call encoder.EncodeScriptFile with the proper parameters. There are four parameters to pass to that method. They are the file extension (only certain file types can be encoded), the string to encode, some optional flags, and the language to use (can be empty). The encoded string is returned. Here is an example of how to use it:
I use .JS as extension, because it is shortest, and works in VBScript, too.
Now we have our first step, which allows us to encode anything we want. The next step relies on the information from the article that I never thought to try before. In fact, there are several things in that article that we use all together. One is that the script can appear anywhere in the file, not just at the start of the file. Next is that not the whole file has to be encoded, so we can have some parts encoded and other parts not encoded, and it will still work. Finally is that multiple scripts can appear in the same file, so we can have lots of pieces of both encoded and not-encoded next to each other, that covers the whole body. We can achieve that by calling the EncodeScriptFile method multiple times and passing different parts of our body. We can choose random amounts of the body to pass to the method. Here is an example of that in VBScript:
Here is the same code in JScript:
That's the easy part. We still have to decide the source of what we want to encode. Since we don't have any kind of DecodeStringFile method, we need to carry our own source, and that is actually tricky. The problem with that is because we need to say "source=" followed by our source, and then to execute it, but the encoded source must also begin with "source=", which can lead to an infinite recursion if we try to do it in one pass. It took me a long time to work out how to do it, but eventually I got it. I just had to build the string in two passes. The first pass is the ordinary source, and the second pass prepends the "source=" part. Of course, the source cannot contain any quotation marks in that case, so it is necessary to append some code to do a replacement at runtime. Here is the code in VBScript, must be single line:
Here is the code in JScript, must be single line:
Active - Benny - Obleak - Prototype - Ratter - Ronin - RT Fishel - sars - SPTH - The Gingerbread Man - Ultras - uNdErX - Vallez - Vecna - VirusBuster - Whitehead