Sample viewer

vx.netlux.org/Virus.DOS.Zorm.643.a

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:51:41.033416319Z 61 PC: 12c24 | Open file (Filename = 'Í ÀŸ')
2018-12-17T22:51:41.03910225Z 26 PC: 12c65 | Set disk transfer address
2018-12-17T22:51:41.042305468Z 71 PC: 12c74 | Get current directory
2018-12-17T22:51:41.045438344Z 78 PC: 12cf5 | Find first file
2018-12-17T22:51:41.057713433Z 61 PC: 12d00 | Open file (Filename = 'TEST.EXE')
2018-12-17T22:51:41.065897216Z 63 PC: 12d0c | Read file or device (Read 26 bytes on handle 5)
2018-12-17T22:51:41.073486203Z 79 PC: 12cf5 | Find next file
2018-12-17T22:51:41.077277725Z 59 PC: 12c8a | Change current directory
2018-12-17T22:51:41.082664384Z 59 PC: 12c99 | Change current directory
2018-12-17T22:51:41.087431129Z 26 PC: 12ca6 | Set disk transfer address
2018-12-17T22:51:41.089091448Z 9 PC: 12a86 | Display string (String= 'Goat file (EXE/9...). Size=000001F4h/0000000500d bytes. ')
2018-12-17T22:51:41.095759865Z 48 PC: 12a8f | Get DOS version
2018-12-17T22:51:41.097860952Z 61 PC: 12b5c | Open file (Filename = '')
2018-12-17T22:51:41.107980563Z 93 PC: 12afe | File sharing functions
2018-12-17T22:51:41.111695521Z 9 PC: 12a86 | Display string (String= 'Size change=0283h/00643d. ')
2018-12-17T22:51:41.117307243Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')