Sample viewer

vx.netlux.org/Virus.DOS.Walker.3846

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:55:20.426389188Z 48 PC: 136c5 | Get DOS version
2018-12-17T22:55:20.428672864Z 42 PC: 9cf9b | Get date 0x9cf9b: mov word ptr cs:[0xf0a], cx
0x9cfa0: mov byte ptr cs:[0xf0c], dh
0x9cfa5: mov byte ptr cs:[0xf0d], dl
0x9cfaa: iret
0x9cfab: mov al, 3
0x9cfad: iret
0x9cfae: push ax
0x9cfaf: push bx
0x9cfb0: push cx
0x9cfb1: push ds
0x9cfb2: push es
0x9cfb3: push si
0x9cfb4: push di
0x9cfb5: mov ax, cs
0x9cfb7: mov ds, ax
0x9cfb9: and byte ptr [0xf27], 0xfe
0x9cfbe: nop
0x9cfbf: mov ah, 0x52
0x9cfc1: int 0x21
0x9cfc3: mov ax, word ptr es:[bx - 2]
2018-12-17T22:55:23.479164874Z 78 PC: 12aa5 | Find first file
2018-12-17T22:55:23.49146543Z 60 PC: 12aae | Create or truncate file
2018-12-17T22:55:23.494520646Z 64 PC: 12ab9 | Write file or device (Write 1219 bytes on handle 2)
2018-12-17T22:55:23.500777344Z 59 PC: 12ac1 | Change current directory
2018-12-17T22:55:23.50539067Z 78 PC: 12aa5 | Find first file
2018-12-17T22:55:23.511793904Z 60 PC: 12aae | Create or truncate file
2018-12-17T22:55:23.515398503Z 64 PC: 12ab9 | Write file or device (Write 1219 bytes on handle 2)
2018-12-17T22:55:23.522646204Z 60 PC: 12ad5 | Create or truncate file
2018-12-17T22:55:23.539563523Z 64 PC: 12ae0 | Write file or device (Write 1219 bytes on handle 5)
2018-12-17T22:55:23.561524908Z 62 PC: 12ae4 | Close file