Sample viewer

vx.netlux.org/Virus.DOS.DieHard2.4000.g

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:15:54.42828986Z 51 PC: 13959 | Get or set Ctrl-Break
2018-12-17T23:15:54.431063846Z 43 PC: 13809 | Set date
2018-12-17T23:15:54.43273496Z 53 PC: 13812 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T23:15:54.434689208Z 48 PC: 138ae | Get DOS version
2018-12-17T23:15:54.436953792Z 47 PC: 12da1 | Get disk transfer address
2018-12-17T23:15:54.438830342Z 26 PC: 12da1 | Set disk transfer address
2018-12-17T23:15:54.440507152Z 78 PC: 12da1 | Find first file
2018-12-17T23:15:54.444796396Z 67 PC: 12da1 | Get or set file attributes
2018-12-17T23:15:54.458053223Z 61 PC: 12da1 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:15:54.465677474Z 63 PC: 12da1 | Read file or device (Read 24 bytes on handle 5)
2018-12-17T23:15:54.468614519Z 66 PC: 12da1 | Move file pointer
2018-12-17T23:15:54.470928477Z 63 PC: 12da1 | Read file or device (Read 54 bytes on handle 5)
2018-12-17T23:15:54.478642438Z 64 PC: 12da1 | Write file or device (Write 1 bytes on handle 5)
2018-12-17T23:15:54.481714421Z 87 PC: 12da1 | Get or set file date and time
2018-12-17T23:15:54.48393766Z 62 PC: 12da1 | Close file
2018-12-17T23:15:54.49217389Z 67 PC: 12da1 | Get or set file attributes
2018-12-17T23:15:54.503011936Z 26 PC: 12da1 | Set disk transfer address
2018-12-17T23:15:54.505535149Z 9 PC: 12a82 | Display string (String= 'Goat file (EXE). Size=000003E8h/0000001000d bytes. ')
2018-12-17T23:15:54.510347423Z 76 PC: 12a86 | Terminate with return code (Return code = '36')