Sample viewer

vx.netlux.org/Virus.DOS.Jerusalem.n3

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:54:35.563647306Z 224 PC: 12ade | UNKNOWN!
2018-12-17T22:54:35.565726857Z 224 PC: 12b32 | UNKNOWN!
2018-12-17T22:54:35.567047281Z 74 PC: 12bb6 | Reallocate memory
2018-12-17T22:54:35.569538531Z 53 PC: 12bbb | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:54:35.571212429Z 37 PC: 12bcf | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:54:35.573437525Z 42 PC: 12bff | Get date 0x12bff: mov byte ptr cs:[0x1c], 0
0x12c05: cmp cx, 0x7c3
0x12c09: je 0x12c3b
0x12c0b: cmp al, 5
0x12c0d: jne 0x12c1c
0x12c0f: cmp dl, 0xd
0x12c12: jne 0x12c1c
0x12c14: inc byte ptr cs:[0x1c]
0x12c19: jmp 0x12c3b
0x12c1b: nop
0x12c1c: mov ax, 0x3508
0x12c1f: int 0x21
0x12c21: mov word ptr cs:[0x21], bx
0x12c26: mov word ptr cs:[0x23], es
0x12c2b: push cs
0x12c2c: pop ds
0x12c2d: mov word ptr [0x2d], 0x7e90
0x12c33: mov ax, 0x2508
0x12c36: mov dx, 0x222
0x12c39: int 0x21
2018-12-17T22:54:35.575971861Z 53 PC: 12c21 | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:54:35.577404597Z 37 PC: 12c3b | Set interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:54:35.579926612Z 75 PC: 12c47 | Execute program
2018-12-17T22:54:35.603146063Z 9 PC: 132a7 | Display string (String= '�THIS IS A GOAT FILE�-D11nmdc-  [13.03.2002] D11N001.COM > 20.000 (4E20h) ... ')
2018-12-17T22:54:35.615664446Z 73 PC: 12c4d | Release memory
2018-12-17T22:54:35.618908501Z 77 PC: 12c51 | Get program return code
2018-12-17T22:54:35.620282774Z 49 PC: 12c5f | Terminate and stay resident (Return code = '0' | Memory size = '112')