Sample viewer

vx.netlux.org/Virus.DOS.Jerusalem.1587

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:53:09.161464401Z 160 PC: 12ae5 | UNKNOWN!
2018-12-17T22:53:09.162683267Z 160 PC: 12b46 | UNKNOWN!
2018-12-17T22:53:09.164425337Z 74 PC: 12bca | Reallocate memory
2018-12-17T22:53:09.166337743Z 53 PC: 12bcf | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:53:09.168070661Z 37 PC: 12be3 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:53:09.170938869Z 42 PC: 12c13 | Get date 0x12c13: mov byte ptr cs:[3], 0
0x12c19: cmp dh, 4
0x12c1c: jne 0x12c2c
0x12c1e: cmp dl, 0x18
0x12c21: jne 0x12c3f
0x12c23: mov byte ptr cs:[3], 0xb
0x12c29: jmp 0x12c5e
0x12c2b: nop
0x12c2c: cmp dh, 7
0x12c2f: jne 0x12c3f
0x12c31: cmp dl, 0x17
0x12c34: jne 0x12c3f
0x12c36: mov byte ptr cs:[3], 0xa
0x12c3c: jmp 0x12c5e
0x12c3e: nop
0x12c3f: mov ax, 0x3508
0x12c42: int 0x21
0x12c44: mov word ptr cs:[0xc], bx
0x12c49: mov word ptr cs:[0xe], es
0x12c4e: push cs
2018-12-17T22:53:09.174743388Z 53 PC: 12c44 | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:53:09.177362447Z 37 PC: 12c5e | Set interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:53:09.179947774Z 75 PC: 12c6a | Execute program
2018-12-17T22:53:09.196803477Z 9 PC: 132c2 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-17T22:53:09.202145384Z 76 PC: 132c6 | Terminate with return code (Return code = '36')
2018-12-17T22:53:09.205837677Z 73 PC: 12c70 | Release memory
2018-12-17T22:53:09.207817588Z 77 PC: 12c74 | Get program return code
2018-12-17T22:53:09.210291778Z 49 PC: 12c82 | Terminate and stay resident (Return code = '36' | Memory size = '126')