Sample viewer

vx.netlux.org/Virus.DOS.Dreg.511

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:51:57.418304628Z 53 PC: 12a53 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:51:57.421112993Z 37 PC: 12a6e | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:51:57.422793911Z 26 PC: 12a81 | Set disk transfer address
2018-12-17T22:51:57.424354954Z 78 PC: 12aaf | Find first file
2018-12-17T22:51:57.432717302Z 61 PC: 12aba | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:51:57.439814534Z 63 PC: 12ac6 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:51:57.447018577Z 62 PC: 12af3 | Close file
2018-12-17T22:51:57.449444344Z 67 PC: 12afe | Get or set file attributes
2018-12-17T22:51:57.507826026Z 61 PC: 12b07 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:51:57.515522274Z 44 PC: 12c12 | Get time 0x12c12: pop di
0x12c13: push dx
0x12c14: push di
0x12c15: ret
0x12c16: lea si, word ptr [bp + 0x10a]
0x12c1a: mov di, si
0x12c1c: mov cx, 0xd7
0x12c1f: lodsw ax, word ptr [si]
0x12c20: jmp 0x12c26
0x12c22: stosw word ptr es:[di], ax
0x12c23: loop 0x12c1f
0x12c25: ret
0x12c26: xor al, byte ptr [bp + 0x2bd]
0x12c2a: xor ah, byte ptr [bp + 0x2be]
0x12c2e: xor ax, word ptr [bp + 0x2c0]
0x12c32: xor ah, byte ptr [bp + 0x2c3]
0x12c36: xor ax, word ptr [bp + 0x2c4]
0x12c3a: xor al, byte ptr [bp + 0x2c6]
0x12c3e: clc
0x12c3f: jae 0x12c22
2018-12-17T22:51:57.518308198Z 44 PC: 12c12 | Get time 0x12c12: pop di
0x12c13: push dx
0x12c14: push di
0x12c15: ret
0x12c16: lea si, word ptr [bp + 0x10a]
0x12c1a: mov di, si
0x12c1c: mov cx, 0xd7
0x12c1f: lodsw ax, word ptr [si]
0x12c20: jmp 0x12c26
0x12c22: stosw word ptr es:[di], ax
0x12c23: loop 0x12c1f
0x12c25: ret
0x12c26: xor al, byte ptr [bp + 0x2bd]
0x12c2a: xor ah, byte ptr [bp + 0x2be]
0x12c2e: xor ax, word ptr [bp + 0x2c0]
0x12c32: xor ah, byte ptr [bp + 0x2c3]
0x12c36: xor ax, word ptr [bp + 0x2c4]
0x12c3a: xor al, byte ptr [bp + 0x2c6]
0x12c3e: clc
0x12c3f: jae 0x12c22
2018-12-17T22:51:57.522412928Z 44 PC: 12c12 | Get time 0x12c12: pop di
0x12c13: push dx
0x12c14: push di
0x12c15: ret
0x12c16: lea si, word ptr [bp + 0x10a]
0x12c1a: mov di, si
0x12c1c: mov cx, 0xd7
0x12c1f: lodsw ax, word ptr [si]
0x12c20: jmp 0x12c26
0x12c22: stosw word ptr es:[di], ax
0x12c23: loop 0x12c1f
0x12c25: ret
0x12c26: xor al, byte ptr [bp + 0x2bd]
0x12c2a: xor ah, byte ptr [bp + 0x2be]
0x12c2e: xor ax, word ptr [bp + 0x2c0]
0x12c32: xor ah, byte ptr [bp + 0x2c3]
0x12c36: xor ax, word ptr [bp + 0x2c4]
0x12c3a: xor al, byte ptr [bp + 0x2c6]
0x12c3e: clc
0x12c3f: jae 0x12c22
2018-12-17T22:51:57.526231081Z 44 PC: 12c12 | Get time 0x12c12: pop di
0x12c13: push dx
0x12c14: push di
0x12c15: ret
0x12c16: lea si, word ptr [bp + 0x10a]
0x12c1a: mov di, si
0x12c1c: mov cx, 0xd7
0x12c1f: lodsw ax, word ptr [si]
0x12c20: jmp 0x12c26
0x12c22: stosw word ptr es:[di], ax
0x12c23: loop 0x12c1f
0x12c25: ret
0x12c26: xor al, byte ptr [bp + 0x2bd]
0x12c2a: xor ah, byte ptr [bp + 0x2be]
0x12c2e: xor ax, word ptr [bp + 0x2c0]
0x12c32: xor ah, byte ptr [bp + 0x2c3]
0x12c36: xor ax, word ptr [bp + 0x2c4]
0x12c3a: xor al, byte ptr [bp + 0x2c6]
0x12c3e: clc
0x12c3f: jae 0x12c22
2018-12-17T22:51:57.528740245Z 44 PC: 12c12 | Get time 0x12c12: pop di
0x12c13: push dx
0x12c14: push di
0x12c15: ret
0x12c16: lea si, word ptr [bp + 0x10a]
0x12c1a: mov di, si
0x12c1c: mov cx, 0xd7
0x12c1f: lodsw ax, word ptr [si]
0x12c20: jmp 0x12c26
0x12c22: stosw word ptr es:[di], ax
0x12c23: loop 0x12c1f
0x12c25: ret
0x12c26: xor al, byte ptr [bp + 0x2bd]
0x12c2a: xor ah, byte ptr [bp + 0x2be]
0x12c2e: xor ax, word ptr [bp + 0x2c0]
0x12c32: xor ah, byte ptr [bp + 0x2c3]
0x12c36: xor ax, word ptr [bp + 0x2c4]
0x12c3a: xor al, byte ptr [bp + 0x2c6]
0x12c3e: clc
0x12c3f: jae 0x12c22
2018-12-17T22:51:57.5321395Z 44 PC: 12c12 | Get time 0x12c12: pop di
0x12c13: push dx
0x12c14: push di
0x12c15: ret
0x12c16: lea si, word ptr [bp + 0x10a]
0x12c1a: mov di, si
0x12c1c: mov cx, 0xd7
0x12c1f: lodsw ax, word ptr [si]
0x12c20: jmp 0x12c26
0x12c22: stosw word ptr es:[di], ax
0x12c23: loop 0x12c1f
0x12c25: ret
0x12c26: xor al, byte ptr [bp + 0x2bd]
0x12c2a: xor ah, byte ptr [bp + 0x2be]
0x12c2e: xor ax, word ptr [bp + 0x2c0]
0x12c32: xor ah, byte ptr [bp + 0x2c3]
0x12c36: xor ax, word ptr [bp + 0x2c4]
0x12c3a: xor al, byte ptr [bp + 0x2c6]
0x12c3e: clc
0x12c3f: jae 0x12c22
2018-12-17T22:51:57.534368397Z 44 PC: 12c12 | Get time 0x12c12: pop di
0x12c13: push dx
0x12c14: push di
0x12c15: ret
0x12c16: lea si, word ptr [bp + 0x10a]
0x12c1a: mov di, si
0x12c1c: mov cx, 0xd7
0x12c1f: lodsw ax, word ptr [si]
0x12c20: jmp 0x12c26
0x12c22: stosw word ptr es:[di], ax
0x12c23: loop 0x12c1f
0x12c25: ret
0x12c26: xor al, byte ptr [bp + 0x2bd]
0x12c2a: xor ah, byte ptr [bp + 0x2be]
0x12c2e: xor ax, word ptr [bp + 0x2c0]
0x12c32: xor ah, byte ptr [bp + 0x2c3]
0x12c36: xor ax, word ptr [bp + 0x2c4]
0x12c3a: xor al, byte ptr [bp + 0x2c6]
0x12c3e: clc
0x12c3f: jae 0x12c22
2018-12-17T22:51:57.536389464Z 66 PC: 12d46 | Move file pointer
2018-12-17T22:51:57.538461066Z 64 PC: 12d5e | Write file or device (Write 511 bytes on handle 5)
2018-12-17T22:51:57.553995458Z 66 PC: 12d67 | Move file pointer
2018-12-17T22:51:57.555483102Z 64 PC: 12d72 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:51:57.561183Z 87 PC: 12b7a | Get or set file date and time
2018-12-17T22:51:57.562998019Z 62 PC: 12b7e | Close file
2018-12-17T22:51:57.569448166Z 67 PC: 12b8d | Get or set file attributes
2018-12-17T22:51:57.577814503Z 26 PC: 12b9f | Set disk transfer address
2018-12-17T22:51:57.579324549Z 37 PC: 12bb0 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')