ProfitPress Mega CDROM2 …eeware (MSDOS)(1992)(Eng)/ProfitPress-MegaCDROM2.B6I/UTILITY/VIRUS/PCV4RPT.ZIP/FISH9.RPT

Text File | 1991-05-28 | 15.0 KB | 269 lines

             *********************************************
             ***   Reports collected and collated by   ***
             ***            PC-Virus Index             ***
             ***      with full acknowledgements       ***
             ***            to the authors             ***
             *********************************************


  Report from Jim Bates - The Virus Information Service - October 1990

  === Whale Virus aka Mother Fish & Fish #9 ===


  Preliminary report on the WHALE virus...

  By far the largest virus that researchers have yet seen was recently
  uploaded to a bulletin board in the U.S. and comprises just under
  10K of code.  The virus has been called The WHALE since that is the
  "title" which appears within the code after the first level of code
  decryption has been executed.  Disassembling this code has proven
  extremely time consuming and is still incomplete due to the
  pressures of other programming work on the various researchers
  currently working on it.  I am indebted to Dr. Peter Lammer of
  SOPHOS and Morgan and Igor of MacAfee Associates for access to their
  work on this and the report which follows collates results from all
  these sources although any errors in analysis or interpretation are
  entirely mine.  Before describing the code in such detail as we
  have, mention should be made of the "motherfish" message which was
  posted anonymously to VIRUS ECHO on FidoNet and reported in full in
  last months Virus Bulletin.  There are several discrepancies in this
  message which might suggest that the sender was either not
  completely familiar with the code or he was spreading deliberate
  dis-information.  Since more than half the virus code is concerned
  with confusing and misinforming anyone trying to disassemble it, I
  incline to the latter argument.  The use of "motherfish" (which does
  not appear in the code) in preference to "whale" is strange, and the
  reference to the virus "learning" detection methods and being a
  "living, breathing entity" is fanciful in the extreme, and
  inaccurate.  That "the virus cannot be detected by present methods"
  is hardly surprising since many newly discovered viruses make use of
  their authors proud new method of encryption/protection ideas.  The
  use of the word "disavow" is interesting since text within the code
  suggests that the author comes from Hamburg where such a word seems
  unlikely to be common parlance.  However, the suggestion that the
  code is modularly constructed seems accurate so unless this was a
  guess we must assume that the sender has SOME knowledge of the virus
  as a whole.


  Heavyweight Confusion Coding

  After self-encrypting and "stealth" viruses, a new term has been
  coined by a member of the Computer Crime Unit at New Scotland Yard.
  "Armoured" virus code describes the deliberate disinformation and
  confusion techniques noted in FISH6 and WHALE.  It is certainly
  appropriate in the case of WHALE since the "armour" outweighs the
  "stealth"!  The WHALE virus is characterised by large sections of
  code (estimated as at least 50% of the total) which involve
  extremely convoluted processing around and across the debug and
  single step interrupt handlers and accessing such hardware as the
  Programmable Interrupt Controller.  There is no other reason for
  this than the confusion of researchers trying to disassemble the
  code and the presence of this code has paradoxically caused
  researchers to heave a sigh of relief.  The reason for this is quite
  simply that such code costs an immense amount of processing time and
  when a machine becomes infected, processing speed slows by up to 50%
  - the WHALE is simply carrying so much programming weight (armour?)
  that its very bulk is its giveaway.  The amount of work involved in
  writing this virus was enormous and could well have been undertaken
  by more than one author.  Program construction seems to be modular
  and no effort has been spared to make the code extremely difficult
  for scanning programs to spot.  Aside from the now accepted
  technique of self encryption, this virus scrambles the order of its
  subroutines and varies the encryption algorithm use during file
  infection.  Also accepted as a "standard" technique now is the
  decryption/recryption process which is used to prevent detection of
  the virus code in memory.  This technique consists of maintaining
  most of the resident virus code in memory in encrypted form and only
  decrypting it just prior to processing.  Once a particular section
  has been executed a re-encryption routine is called which collects a
  new pseudo-random key value and re-encrypts the code just executed
  before stored the new key and continuing to the next part of the
  code.  The result is that only a small "window" around the code
  currently being executed is actually "in plain view", the remainder
  is variously and randomly encrypted.  This is obviously to forestall
  the possibility of a recognition string being used to identify virus
  code in memory.  The author obviously likes this technique since it
  is used at least 96 times throughout the code!  This is another part
  of the bulk that this unwieldy virus carries.  As with other recent
  viruses, there are several "undocumented" system calls (most of
  which are now well documented within the technical community) but
  two have been noted which may relate to specific packages, possibly
  of an anti-virus nature.

  There is still much work to be done in dissecting this code and the
  details that we have so far uncovered are necessarily fairly
  sketchy.  We can say that this is a parasitic virus which infects
  executables with an infection length of around 9416 bytes.  The
  actual appended length varies quite a lot from infection to
  infection and this is probably due to the insertion of some random
  junk and alignment of code on paragraph boundaries.  No simple
  search string is possible because of the multiple encryption
  techniques and modular scrambling.  There are considerable sections
  of self-modifying, self-checking and self-switching code within
  WHALE. This last technique consists of laboriously switching
  individual bytes within a specific subroutine using precalculated
  XOR values.  The result is a sort of global XOR effect which can be
  used to switch between two different routines or as a
  decrypt/recrypt process.

  The code appears to install itself as resident within the first
  available Memory Control Block and monitors system activity during
  normal DOS processing.  Stealth techniques are used to fool DOS into
  reporting original file sizes rather than the increased ones when
  files become infected.  This is done by intercepting the DOS Get
  File Size function (23H) and checking whether the target file is
  infected before returning either a true or modified file size to the
  calling routine.  The virus' method of detecting infection is still
  being analysed but there is some evidence that several checks are
  made, failure of any one of which will indicate that a file is NOT
  infected.  The complexity of these checks necessarily means that a
  "sparse infection" method (ie: not all files will be infected) may
  be employed.  This makes external detection more difficult but it
  does reduce the virility of the code and should mean that if this
  does appear "in the wild", it is unlikely to exist for long before
  detection and would therefore not spread too far.  One of the checks
  for infection seems to be that the hour field in the file time must
  be equal to or greater than 16 (ie:  4pm or later) since the top bit
  of that field is modified within the Function 57H (Get/Set file
  Date/Time) handler.  This too may limit the number of files suitable
  for infection.

  There are several similarities with the FISH6 and 4K viruses and
  this might indicate either a distinct development cycle by the
  author(s) or simply that someone has copied useful code and ideas
  from the earlier specimens.  I incline to the former view but
  whatever the truth of the matter the similarity in file infection
  technique provides a useful method of identifying the presence of
  any of these three viruses.  In the case of WHALE however, it is
  reported from the U.S. that some generations may not display this
  similarity and might therefore slip through this particular
  detection net.  The technique itself is discussed in the 4K data
  infection report elsewhere in this issue and with the exception of
  the differences in infected length (and the as yet unconfirmed U.S.
  reports), all three viruses show identical repetition of the
  original host header information.

  The external results of running the WHALE have so far produced at
  least 27 different "generations" (I dislike the term "mutations" as
  implying uncontrolled change) and each generation appears to be the
  result of scrambling the order in which subroutines are written to
  the target file as well as changing both the encryption 'lock' and
  'key'.  There is a counting mechanism fairly close to the beginning
  of the virus code which counts back from 0F0H (240 decimal) on the
  dissection copy but the significance of this has not yet become
  clear.  Possibly sections of the virus yet to be dissected may be
  invoked when the counter reaches zero.  Infection apparently takes
  place during a Function 4BH call to DOS (Load and Execute) and will
  therefore affect COM, EXE, OVR and other executable code which is
  run in this way.  At various times, the Interrupt vector addresses
  for Interrupts 1, 2, 3, 9, 13H, 24H and 2FH are accessed and may be
  modified for use by the virus code.  The main area of code
  subversion centres around the DOS Interrupt 21H and this is
  intercepted and passed through a function dispatcher routine.  This
  dispatcher monitors 15 separate DOS functions including both types
  of Find First/Next (11H, 12H, 4EH and 4FH), Open and Close file
  operations (0FH, 3DH and 3EH) and various types of File Read and
  Seek calls (14H, 21H, 27H and 42H).  Other functions handled are Get
  File Size (23H), Load and Execute (4BH) and Get/Set Date/Time (57H).
  As is now expected of this type of code, the DOS Critical Error
  vector is hooked during virus operation and appears to be correctly
  restored after use.

  As various layers of encryption are peeled back, two areas of plain
  text are revealed.  The first of these is written to a hidden file
  in the root directory of the C:  drive on a 4 to 1 random chance.
  This file is named FISH-#9.TBL and contains a copy of the boot
  sector of the drive, together with the following plain text ...

  FISH VIRUS #9   A Whale is no Fish! Mind her Mutant Fish and the
  hidden Fish Eggs for they are damaging.  The sixth Fish mutates only
  if the Whale is in here Cave.

  No other reference is made to this file from within the virus code
  and the content seems to indicate an adolescent concern with
  mysterious misinformation.  The "sixth Fish" may refer to the FISH6
  virus (and establish another definite link) but this has yet to be
  researched.  Since I haven't yet disassembled FISH6, I would be
  interested to know just how it got its name (why the '6' ?).  It is
  also interesting to note that TBL is one of the data file extensions
  attacked by the 4K virus (see article elsewhere in this issue).

  The second plain text section of code is displayed as a message if
  the system date is between 19th February and 20th March in any year
  except 1991 and then the system hangs with a Divide Overflow
  message, necessitating a power down reboot.  This is the only
  trigger point noted so far but there is a possibility that even
  these dates may be modified within differing generations.  The
  message reads ...

  THE WHALE IN SEARCH OF THE 8 FISH I AM '~knzyvo}' IN HAMBURG

  This is exactly as the message appears on screen and the characters
  between the single quotes appear to be a name of some sort.
  Preliminary cryptanalysis suggests that this name is probably
  'TADPOLES' since this results from simply subtracting a value of 42
  (decimal) from each character value and the ichthyological
  connection is obvious.  Whether the author(s) actually do come from
  Hamburg is not certain, since they are capable of producing this
  ludicrously silly code it is quite probable that they are
  pathological liars as well.

  Many researchers have conjectured that WHALE might be designed to
  interact with other viruses (notably FISH6) but to date, no evidence
  of this has yet been found within the code.

  As knowledge currently stands on this virus, it may well be an
  extremely childish and malicious attempt to waste the time of virus
  researchers across the world.  In rather the same way that the Fire
  Brigade can never ignore false alarms, the virus research community
  cannot ignore even the simplest virus code.  However, ANY virus code
  is potentially destructive and the perpetrators should be aware that
  the Computer Crime Unit at New Scotland Yard are now building a
  dossier of computer virus incidents in the U.K.  and WILL prosecute
  the authors even if they have never set foot in this country.  Under
  current legislation, conviction could carry a five year prison
  sentence.  If 'TADPOLES' reads this, he/they might like to speculate
  on such a sentence, which would undoubtedly be accompanied then and
  subsequently by the universal revulsion of the computing community
  world-wide.

  The arrival of this virus caused much consternation amongst
  knowledgeable researchers but preliminary examination has dispelled
  most of this concern.  It is interesting to speculate that in the
  WHALE, virus authors have at last reached a predicted point where
  their code has to carry so much protection that the original
  parameters of invisibility and mobility can no longer be maintained
  with any real reliability.  Such bulky and processor intensive code
  will generally reveal itself long before any payload can be
  delivered.

  Work will continue on disassembling and analysing this virus until
  all the fine details are known and further reports will appear as
  more information becomes available.

  VIS Classification - CEARKSd9416

  The information contained in this report is the direct result of
  disassembling and analysing a specimen of the virus code.  I take
  great pains to ensure the accuracy of these analyses but I cannot
  accept responsibility for any loss or damage suffered as a result of
  any errors or omissions.  If any errors of fact are noted, please
  let me know at :-

    The Virus Information Service,
    Treble Clef House,
    64, Welford Road,
    WIGSTON MAGNA,
    Leicester  LE8 1SL

  or call [phone]

  Jim Bates

  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  ++++++++++++++++++++++++++ end of reports ++++++++++++++++++++++++
  ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++