Sample viewer

vx.netlux.org/Trojan.DOS.QHA.h

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:50:05.722871764Z 48 PC: 17dfe | Get DOS version
2018-12-17T22:50:05.724503328Z 74 PC: 17e4e | Reallocate memory
2018-12-17T22:50:05.726257757Z 48 PC: 17c0c | Get DOS version
2018-12-17T22:50:05.727594727Z 53 PC: 17c14 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:50:05.729328999Z 37 PC: 17c26 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:50:05.730566198Z 68 PC: 17cb7 | I/O control for devices (Set for = '�u�_���״A�!r �O�!s�_^]�')
2018-12-17T22:50:05.731901074Z 68 PC: 17cb7 | I/O control for devices
2018-12-17T22:50:05.734090437Z 68 PC: 17cb7 | I/O control for devices
2018-12-17T22:50:05.735363629Z 68 PC: 17cb7 | I/O control for devices
2018-12-17T22:50:05.73664989Z 68 PC: 17cb7 | I/O control for devices
2018-12-17T22:50:05.739094951Z 53 PC: 15a52 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:50:05.740264138Z 53 PC: 15a5f | Get interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T22:50:05.741394851Z 53 PC: 15a6c | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:50:05.743120761Z 37 PC: 15a81 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:50:05.74428886Z 37 PC: 15a89 | Set interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T22:50:05.745412028Z 37 PC: 15a91 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:50:05.747191213Z 53 PC: 15fca | Get interrupt vector (Interrupt = '239' AKA 'UNKNOWN!')
2018-12-17T22:50:05.748528995Z 53 PC: 15fd7 | Get interrupt vector (Interrupt = '240' AKA 'UNKNOWN!')
2018-12-17T22:50:05.749919214Z 53 PC: 15fe6 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-17T22:50:05.76000335Z 37 PC: 15ff3 | Set interrupt vector (Interrupt = '239' AKA 'UNKNOWN!')
2018-12-17T22:50:05.762427718Z 53 PC: 15ffa | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:50:05.764703309Z 37 PC: 16007 | Set interrupt vector (Interrupt = '240' AKA 'UNKNOWN!')
2018-12-17T22:50:05.767081401Z 53 PC: 16013 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-17T22:50:05.771160015Z 48 PC: 160d5 | Get DOS version
2018-12-17T22:50:05.772622525Z 74 PC: 171e1 | Reallocate memory
2018-12-17T22:50:05.774637354Z 74 PC: 171e1 | Reallocate memory
2018-12-17T22:50:05.77586232Z 68 PC: 159c8 | I/O control for devices (Set for = '=>[]|')
2018-12-17T22:50:05.777040796Z 68 PC: 159c8 | I/O control for devices (Set for = '')
2018-12-17T22:50:05.78032982Z 51 PC: 159e6 | Get or set Ctrl-Break
2018-12-17T22:50:05.793591762Z 51 PC: 159f2 | Get or set Ctrl-Break
2018-12-17T22:50:05.800551897Z 61 PC: 1310e | Open file (Filename = 'C:\WINDOWS\SYSTEM\QHA.PRT')
2018-12-17T22:50:05.812835221Z 60 PC: 12fd3 | Create or truncate file
2018-12-17T22:50:06.176282593Z 62 PC: 14459 | Close file
2018-12-17T22:50:06.17829507Z 61 PC: 1310e | Open file (Filename = 'C:\WINDOWS\SYSTEM\QHA.PRT')
2018-12-17T22:50:06.186616133Z 68 PC: 13067 | I/O control for devices (Set for = 'R> �*�*R;y(�;�;�;. "+,:;<=>[]|')
2018-12-17T22:50:06.188478986Z 66 PC: 141fb | Move file pointer
2018-12-17T22:50:06.189788538Z 63 PC: 14422 | Read file or device (Read 50 bytes on handle 5)
2018-12-17T22:50:06.192587602Z 62 PC: 14459 | Close file
2018-12-17T22:50:06.194672096Z 25 PC: 12be1 | Get default drive
2018-12-17T22:50:06.195622484Z 13 PC: 12be6 | Disk reset
2018-12-17T22:50:06.198026029Z 14 PC: 12bed | Set default drive (Drive = 'A')
2018-12-17T22:50:06.200016812Z 26 PC: 12bcd | Set disk transfer address
2018-12-17T22:50:06.20101215Z 78 PC: 12bd4 | Find first file
2018-12-17T22:50:06.212817036Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.214650898Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.216667401Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.219314028Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.221463436Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.223488479Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.22593588Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.228537257Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.230468979Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.232995988Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.235441832Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.237322765Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.239712652Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.241616281Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.244051778Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.247153321Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.249777729Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.252180434Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.255012946Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.256989348Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.259350616Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.262131472Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.264166503Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.266173662Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.2688352Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.271003297Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.272959812Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.275211129Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.277637327Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.279515245Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.281427052Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.283688496Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.285640903Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.288054601Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.291196459Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.293344528Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.295811097Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.298759359Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.301157171Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.30353592Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.306698963Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.309457604Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.311463054Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.317455299Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.319339107Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.321278047Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.324364114Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.326346147Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.328247856Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.331326078Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.333629202Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.335939592Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.339205298Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.341502049Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.343786185Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.347213823Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.349569396Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.351760853Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.355155962Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.357031303Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.359037368Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.362506588Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.364576952Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.366602911Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.369100165Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.372229933Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.37435811Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.377027582Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.378978726Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.380883101Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.383370211Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.38532763Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.387253507Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.390543492Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.392098908Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.393488158Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.397126793Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.399108646Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.401066814Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.403999894Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.406028095Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.407983749Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.410403183Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.412468039Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.414448208Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.417247868Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.419186043Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.421275188Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.433716256Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.435647673Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.43752135Z 6 PC: 15999 | Direct console I/O
2018-12-17T22:50:06.440900503Z 12 PC: 15a42 | Flush input buffer and input