Sample viewer

vx.netlux.org/Virus.DOS.HLLW.Pozdrav.7748

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:51:14.184653599Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:51:14.186517418Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:51:14.187759587Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:51:14.188990478Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:51:14.191267733Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:51:14.192486482Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:51:14.193740515Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:51:14.195980568Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:51:14.19722213Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:51:14.19854059Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:51:14.199898848Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:51:14.201797294Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:51:14.202970101Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:51:14.204216934Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:51:14.221585477Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:51:14.222845881Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:51:14.22411339Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:51:14.226065143Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:51:14.228303221Z 53 PC: 14f4a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:51:14.240619958Z 37 PC: 14f5f | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:51:14.242362976Z 37 PC: 14f67 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:51:14.244069679Z 37 PC: 14f6f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:51:14.245513976Z 37 PC: 14f77 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:51:14.247589198Z 68 PC: 1583b | I/O control for devices (Set for = 'H�L ) u^�%�8�D6 ��ĴI� %�6� ˘g4�&06��,�*{g+@1:g0�NB��Fl�o���; �k���O&71<�[!Zlba&-.h��')
2018-12-17T22:51:14.333817354Z 37 PC: 14971 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:51:14.335347723Z 42 PC: 14717 | Get date 0x14717: xor ah, ah
0x14719: les di, ptr [bp + 6]
0x1471c: stosw word ptr es:[di], ax
0x1471d: mov al, dl
0x1471f: les di, ptr [bp + 0xa]
0x14722: stosw word ptr es:[di], ax
0x14723: mov al, dh
0x14725: les di, ptr [bp + 0xe]
0x14728: stosw word ptr es:[di], ax
0x14729: xchg ax, cx
0x1472a: les di, ptr [bp + 0x12]
0x1472d: stosw word ptr es:[di], ax
0x1472e: pop bp
0x1472f: retf 0x10
0x14732: push bp
0x14733: mov bp, sp
0x14735: mov cx, word ptr [bp + 0xa]
0x14738: mov dh, byte ptr [bp + 8]
0x1473b: mov dl, byte ptr [bp + 6]
0x1473e: mov ah, 0x2b
2018-12-17T22:51:14.338530496Z 53 PC: 1489a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:51:14.340066131Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:51:14.341291893Z 53 PC: 1489a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:51:14.342632937Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:51:14.345426509Z 53 PC: 1489a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:51:14.347698001Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:51:14.349791855Z 53 PC: 1489a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:51:14.353962318Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:51:14.355186957Z 53 PC: 1489a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:51:14.35654142Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:51:14.362804688Z 53 PC: 1489a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:51:14.364502299Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:51:14.36609912Z 53 PC: 1489a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:51:14.368646565Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:51:14.36991436Z 53 PC: 1489a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:51:14.371168181Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:51:14.373368697Z 53 PC: 1489a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:51:14.374663772Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:51:14.375844466Z 53 PC: 1489a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:51:14.378114052Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:51:14.379091575Z 53 PC: 1489a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:51:14.380242787Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:51:14.382370899Z 53 PC: 1489a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:51:14.383642106Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:51:14.384843329Z 53 PC: 1489a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:51:14.386963571Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:51:14.388153913Z 53 PC: 1489a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:51:14.389325632Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:51:14.390699207Z 53 PC: 1489a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:51:14.392116261Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:51:14.393352481Z 53 PC: 1489a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:51:14.394867091Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:51:14.396829929Z 53 PC: 1489a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:51:14.39836091Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:51:14.40000876Z 53 PC: 1489a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:51:14.401443268Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:51:14.402629372Z 53 PC: 1489a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:51:14.40406873Z 37 PC: 148a3 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:51:14.406792208Z 41 PC: 14851 | Parse filename
2018-12-17T22:51:14.408244372Z 41 PC: 1485f | Parse filename
2018-12-17T22:51:14.409685438Z 75 PC: 1486a | Execute program
2018-12-17T22:51:14.431181685Z 80 PC: 1a459 | Set current PSP
2018-12-17T22:51:14.432388013Z 48 PC: 1a45e | Get DOS version
2018-12-17T22:51:14.434261152Z 99 PC: 20c40 | Get DBCS lead byte table pointer
2018-12-17T22:51:14.43853326Z 101 PC: 1a4e4 | Get extended country info
2018-12-17T22:51:14.44008647Z 99 PC: 1a4ea | Get DBCS lead byte table pointer
2018-12-17T22:51:14.441717734Z 74 PC: 1a54c | Reallocate memory
2018-12-17T22:51:14.444634692Z 25 PC: 1a583 | Get default drive
2018-12-17T22:51:14.44608741Z 37 PC: 1a043 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T22:51:14.447581109Z 37 PC: 1a04a | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:51:14.450013723Z 37 PC: 1a051 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:51:14.454583157Z 74 PC: 191ec | Reallocate memory
2018-12-17T22:51:14.456304247Z 72 PC: 1922d | Allocate memory
2018-12-17T22:51:14.459174191Z 72 PC: 19265 | Allocate memory
2018-12-17T22:51:14.461136939Z 72 PC: 1926d | Allocate memory