Sample viewer

vx.netlux.org/Virus.DOS.HLLC.6888

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:55:18.354571109Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:55:18.356223376Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:55:18.357397289Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:55:18.358547392Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:55:18.360492469Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:55:18.361791176Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:55:18.362980668Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:55:18.364346991Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:55:18.365674735Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:55:18.366714569Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:55:18.367768896Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:55:18.369421462Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:55:18.370526011Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:55:18.371645841Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:55:18.37392004Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:55:18.374924179Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:55:18.375896028Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:55:18.377686789Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:55:18.3787338Z 53 PC: 154c2 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:55:18.38004522Z 37 PC: 154d7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:55:18.381920423Z 37 PC: 154df | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:55:18.383098608Z 37 PC: 154e7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:55:18.384230041Z 37 PC: 154ef | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:55:18.386604551Z 68 PC: 1585f | I/O control for devices (Set for = '')
2018-12-17T22:55:18.455027249Z 37 PC: 14ee5 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:55:18.45750822Z 42 PC: 14be7 | Get date 0x14be7: xor ah, ah
0x14be9: les di, ptr [bp + 6]
0x14bec: stosw word ptr es:[di], ax
0x14bed: mov al, dl
0x14bef: les di, ptr [bp + 0xa]
0x14bf2: stosw word ptr es:[di], ax
0x14bf3: mov al, dh
0x14bf5: les di, ptr [bp + 0xe]
0x14bf8: stosw word ptr es:[di], ax
0x14bf9: xchg ax, cx
0x14bfa: les di, ptr [bp + 0x12]
0x14bfd: stosw word ptr es:[di], ax
0x14bfe: pop bp
0x14bff: retf 0x10
0x14c02: push bp
0x14c03: mov bp, sp
0x14c05: mov cx, word ptr [bp + 0xa]
0x14c08: mov dh, byte ptr [bp + 8]
0x14c0b: mov dl, byte ptr [bp + 6]
0x14c0e: mov ah, 0x2b
2018-12-17T22:55:18.46009154Z 26 PC: 14cb9 | Set disk transfer address
2018-12-17T22:55:18.461179383Z 78 PC: 14cc5 | Find first file
2018-12-17T22:55:18.467519881Z 26 PC: 14cb9 | Set disk transfer address
2018-12-17T22:55:18.468756854Z 78 PC: 14cc5 | Find first file
2018-12-17T22:55:18.474897813Z 48 PC: 1629e | Get DOS version
2018-12-17T22:55:18.476218048Z 61 PC: 160ea | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:55:18.483371607Z 60 PC: 160ea | Create or truncate file
2018-12-17T22:55:18.500673249Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.507103817Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.51432191Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.521832672Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.529418105Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.53617979Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.544856168Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.551993563Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.559663534Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.56727151Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.574924504Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.581698205Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.589798399Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.595220691Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.600071635Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.604940926Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.60973984Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.614268285Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.619861476Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.624183301Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.628993411Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.633311065Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.638444007Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.642794314Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.648783389Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.653268838Z 64 PC: 161bd | Write file or device (Write 512 bytes on handle 6)
2018-12-17T22:55:18.658568801Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.660704456Z 64 PC: 161bd | Write file or device (Write 232 bytes on handle 6)
2018-12-17T22:55:18.663432998Z 63 PC: 161bd | Read file or device (Read 512 bytes on handle 5)
2018-12-17T22:55:18.664724344Z 62 PC: 1613a | Close file
2018-12-17T22:55:18.666040723Z 62 PC: 1613a | Close file
2018-12-17T22:55:18.671697414Z 67 PC: 14c88 | Get or set file attributes
2018-12-17T22:55:18.677824583Z 48 PC: 1629e | Get DOS version
2018-12-17T22:55:18.679538294Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:55:18.680962527Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:55:18.681876262Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:55:18.682795686Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:55:18.684239562Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:55:18.685421606Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:55:18.686248023Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:55:18.687580125Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:55:18.688542424Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:55:18.689605943Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:55:18.690977868Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:55:18.691786708Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:55:18.692567975Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:55:18.693967592Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:55:18.695007779Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:55:18.695995995Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:55:18.697351524Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:55:18.698206169Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:55:18.699217655Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:55:18.700691163Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:55:18.701596811Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:55:18.702581101Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:55:18.703886813Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:55:18.704801571Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:55:18.705815631Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:55:18.707440806Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:55:18.708368406Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:55:18.709309227Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:55:18.710600355Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:55:18.711500142Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:55:18.712384109Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:55:18.714020219Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:55:18.714877626Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:55:18.715807629Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:55:18.717262342Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:55:18.718188976Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:55:18.719105163Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:55:18.72065188Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:55:18.721758775Z 41 PC: 14da9 | Parse filename
2018-12-17T22:55:18.722891857Z 41 PC: 14db7 | Parse filename
2018-12-17T22:55:18.724585267Z 75 PC: 14dc2 | Execute program
2018-12-17T22:55:18.727735787Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:55:18.728736265Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:55:18.730474499Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:55:18.73145625Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:55:18.732432791Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:55:18.734032667Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:55:18.734983188Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:55:18.735948954Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:55:18.737605491Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:55:18.738567607Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:55:18.73954301Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:55:18.741032773Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:55:18.742010357Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:55:18.743056258Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:55:18.744591689Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:55:18.745559108Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:55:18.746584209Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:55:18.748515717Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:55:18.750002529Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:55:18.751446614Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:55:18.752921494Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:55:18.754046449Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:55:18.754978015Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:55:18.756535714Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:55:18.757643845Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:55:18.758709494Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:55:18.760174373Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:55:18.76117456Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:55:18.766226654Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:55:18.768118651Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:55:18.769139385Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:55:18.7701407Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:55:18.771562804Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:55:18.772556019Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:55:18.773519643Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:55:18.775083826Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:55:18.776145408Z 53 PC: 14d20 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:55:18.777163247Z 37 PC: 14d29 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:55:18.778284123Z 77 PC: 14de0 | Get program return code
2018-12-17T22:55:18.779533237Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:55:18.780507348Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:55:18.782846226Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:55:18.784282162Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:55:18.785418873Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:55:18.786827805Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:55:18.787829079Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:55:18.789205625Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:55:18.79094434Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:55:18.791974796Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:55:18.792850118Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:55:18.794534273Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:55:18.795697179Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:55:18.796653313Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:55:18.798323342Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:55:18.799320841Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:55:18.800236267Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:55:18.801649617Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:55:18.803000942Z 37 PC: 155d6 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:55:18.803905556Z 76 PC: 15615 | Terminate with return code (Return code = '0')