Sample viewer

vx.netlux.org/Virus.DOS.PS-MPC.Lucky.621

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:55:09.779980037Z 53 PC: 12c55 | Get interrupt vector (Interrupt = '32' AKA 'Reserved')
2018-12-17T22:55:09.784215352Z 26 PC: 12c88 | Set disk transfer address
2018-12-17T22:55:09.785741291Z 53 PC: 12c90 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:55:09.787527646Z 37 PC: 12ca0 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:55:09.789780764Z 78 PC: 12cb0 | Find first file
2018-12-17T22:55:09.795811953Z 67 PC: 12e79 | Get or set file attributes
2018-12-17T22:55:09.813738524Z 61 PC: 12cc0 | Open file (Filename = 'TEST.EXE')
2018-12-17T22:55:09.821303992Z 63 PC: 12cd0 | Read file or device (Read 26 bytes on handle 5)
2018-12-17T22:55:09.824993851Z 66 PC: 12cdd | Move file pointer
2018-12-17T22:55:09.826785569Z 87 PC: 12cf4 | Get or set file date and time
2018-12-17T22:55:09.828582917Z 62 PC: 12cfa | Close file
2018-12-17T22:55:09.835496046Z 67 PC: 12e79 | Get or set file attributes
2018-12-17T22:55:09.844861726Z 79 PC: 12cb0 | Find next file
2018-12-17T22:55:09.847172877Z 37 PC: 12d1e | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:55:09.848966347Z 26 PC: 12d2a | Set disk transfer address
2018-12-17T22:55:09.850250413Z 9 PC: 12a82 | Display string (String= 'Goat file (EXE). Size=000003E8h/0000001000d bytes. ')
2018-12-17T22:55:09.854632574Z 76 PC: 12a86 | Terminate with return code (Return code = '36')