File Infector Viruses

Question 1

Explain the Appending Virus?

Answer 1

1. Add the malware code at the end of the host file.
2. Save the Original Entry Point location for later use
3. Modify the Original Entry Point to point to the start of the appended malware code.
4. Now when the file is run, it will first run the malware.

Question 2

Explain the Prepending Virus?

Answer 2

1. Add the malware code at the end of the host files headers, but before the main code/data.
2. Save the Original Entry Point location for later use
3. Modify the Original Entry Point to point to the start of the appended malware code.
4. Now when the file is run, it will first run the malware.

Question 3

Explain the WinPE Infecting Virus?

Answer 3

For WinPE file infectors, they are a bit more complex. They work by placing malware code in the empty spaces of a file:

1. Save the Original Entry Point location for later use
2. Place the malware code in free space within the file (e.g. In the padding space between PE File sections). Each block of malware code jumps to the next block
3. Modify the Original Entry Point to point to the start of the malware code.
4. Now when the file is run, it will first run the malware.

Question 4

Explain the Overwriting Virus?

Answer 4

1. Place the malware code in the file, overwriting other components if needed.
2. Modify the Original Entry Point to point to the start of the malware code.
3. Now when the file is run, it will first run the malware. However the original host file will normally have been at least partially destroyed by the infection process, so the malware will not bother to run it also.

Question 5

Explain the Not Modifying Entry Point Virus?

Answer 5

Some File infectors will not alter the Entry Point, as this can be used to detect something unusual is going on.

Here the malware will first save the first couple of bytes of the original code, and place it at the end of its own. It will then overwrite these bytes with a jump to its own code.

The malware code will then execute as normal. At the end it will run the first bytes of the original code, and then jmp back to the next instruction of the original code.

Question 6

Explain the Master Boot Record Virus?

Answer 6

Finally we have a Master Boot Record virus These infect the entire disk, not just a single file. The MBR holds details on the systems partition table and is responsible for deciding what code on the machine executes first. Infecting this allows a malware to run before the OS itself.

These can be very tricky to clean, and there have been several famous examples such as Brain, Elk Cloner, Mebroot

Question 7

Name the different types of File Infector Viruses?

Answer 7

1. Appending
2. Prepending
3. WinPE
4. Overwriting
5. Not modifying entry point
6. MBR