Sample viewer

vx.netlux.org/Trojan.DOS.Erase26.p

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:55:30.710357602Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.712645826Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.71430183Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.715366413Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.717961514Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.719415488Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.720912924Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.722550614Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.727587588Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.729264913Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.73154445Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.733690977Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.735764707Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.737282411Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.742558975Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.744113138Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.746891985Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.748958992Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.751506313Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.752941452Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.755583621Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.757240177Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.759264194Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.763542951Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.765195599Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.766727179Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.768913581Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.770554537Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.772478687Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.781738241Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.783606415Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.785060139Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.787307676Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.789763325Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.792488961Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.794773968Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.798014252Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.799413865Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.80114991Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.803923286Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.805865699Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.807453966Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.810563414Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.812006909Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.814044772Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.816443754Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.818298081Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.819649282Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.82241837Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.823767247Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.82638476Z 37 PC: 12acb | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:55:30.828584257Z 37 PC: 12acf | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:55:30.83105832Z 9 PC: 12b47 | Display string (String= 'Natas Kaupas Says 'You're Totally Phucked! Up' [YAM 92]')
2018-12-17T22:55:33.037928207Z 72 PC: 8f1b9 | Allocate memory
2018-12-17T22:55:33.040993672Z 72 PC: 8f1bd | Allocate memory
2018-12-17T22:55:33.043898505Z 99 PC: 90858 | Get DBCS lead byte table pointer
2018-12-17T22:55:33.047317535Z 61 PC: 91f88 | Open file (Filename = 'C:\WINDOWS\HIMEM.SYS')
2018-12-17T22:55:33.059576642Z 66 PC: 91f95 | Move file pointer
2018-12-17T22:55:33.062087013Z 62 PC: 91fc1 | Close file
2018-12-17T22:55:33.064617863Z 75 PC: 91fe0 | Execute program
2018-12-17T22:55:33.082972042Z 98 PC: 916f1 | Get current PSP
2018-12-17T22:55:33.085366305Z 9 PC: c605 | Display string (String= '6��r�&;] u')
2018-12-17T22:55:33.089992004Z 48 PC: c609 | Get DOS version
2018-12-17T22:55:33.093487288Z 9 PC: c382 | Display string (String= ' Installed A20 handler number ')
2018-12-17T22:55:33.097233704Z 2 PC: c38c | Character output (Char = '32')
2018-12-17T22:55:33.099902543Z 2 PC: c3a7 | Character output (Char = '2e')
2018-12-17T22:55:33.103993057Z 9 PC: c6d9 | Display string (String= '�����VH�VD���V@��������������_���Ku��t1��������D�����t �� ��������a1��Z�����W���� ������5���|�����(���������Nj�(��������p�^')
2018-12-17T22:55:33.110016355Z 9 PC: c6e0 | Display string (String= '�5���|�����(���������Nj�(��������p�^')
2018-12-17T22:55:33.115514184Z 61 PC: 91f88 | Open file (Filename = 'C:\WINDOWS\SMARTDRV.EXE')
2018-12-17T22:55:33.126820399Z 66 PC: 91f95 | Move file pointer
2018-12-17T22:55:33.129907094Z 62 PC: 91fc1 | Close file
2018-12-17T22:55:33.132466667Z 75 PC: 91fe0 | Execute program
2018-12-17T22:55:33.154345666Z 98 PC: 916f1 | Get current PSP
2018-12-17T22:55:33.159358894Z 82 PC: 13d46 | Get DOS internal pointers (SYSVARS)
2018-12-17T22:55:33.161381538Z 53 PC: 13ac3 | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-17T22:55:33.162937564Z 37 PC: 13ad6 | Set interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-17T22:55:33.164458675Z 53 PC: 13ae0 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:55:33.16699733Z 37 PC: 13af3 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:55:33.168621334Z 9 PC: 13a0d | Display string (Could not find end pointer)
2018-12-17T22:55:33.177763528Z 62 PC: 8f8eb | Close file
2018-12-17T22:55:33.181195062Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.183488866Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.185438963Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.188081172Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.190305305Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.192250664Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.195100985Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.197049009Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.198994117Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.201175269Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.206754572Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.208692176Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.210601878Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.21418663Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.216194276Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.21819023Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.222038307Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.224054108Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.22586333Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.228489589Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.23066452Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.232496675Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.238626835Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.24121361Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.242836202Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.244428496Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.24645647Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.248369668Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.250319265Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.253126224Z 62 PC: 8f8f2 | Close file
2018-12-17T22:55:33.255102611Z 61 PC: 8f8ff | Open file (Filename = '')
2018-12-17T22:55:33.261401879Z 62 PC: 8f90e | Close file
2018-12-17T22:55:33.264776185Z 69 PC: 8f915 | Duplicate handle
2018-12-17T22:55:33.266747763Z 69 PC: 8f919 | Duplicate handle
2018-12-17T22:55:33.268683463Z 61 PC: 9387b | Open file (Filename = '')
2018-12-17T22:55:33.274636178Z 68 PC: 9386b | I/O control for devices (Set for = '')
2018-12-17T22:55:33.276425193Z 61 PC: 9387b | Open file (Filename = '')
2018-12-17T22:55:33.282905772Z 68 PC: 9386b | I/O control for devices (Set for = '')
2018-12-17T22:55:33.285375496Z 74 PC: 8f9c4 | Reallocate memory
2018-12-17T22:55:33.28808411Z 72 PC: 8f9e0 | Allocate memory
2018-12-17T22:55:33.290045078Z 72 PC: 8f9e4 | Allocate memory
2018-12-17T22:55:33.291753662Z 74 PC: 8f9fb | Reallocate memory
2018-12-17T22:55:33.294487273Z 72 PC: 8fa02 | Allocate memory
2018-12-17T22:55:33.296339186Z 72 PC: 8fa06 | Allocate memory
2018-12-17T22:55:33.298134211Z 73 PC: 8fa11 | Release memory
2018-12-17T22:55:33.301585121Z 73 PC: 8efea | Release memory
2018-12-17T22:55:33.303023136Z 74 PC: 8f003 | Reallocate memory
2018-12-17T22:55:33.304719266Z 72 PC: 8f054 | Allocate memory
2018-12-17T22:55:33.307409306Z 72 PC: 8f058 | Allocate memory
2018-12-17T22:55:33.30910796Z 73 PC: 8f060 | Release memory
2018-12-17T22:55:33.310606368Z 61 PC: 8f080 | Open file (Filename = '')
2018-12-17T22:55:33.324765187Z 63 PC: 8f095 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:55:33.335208739Z 66 PC: 8f0ad | Move file pointer
2018-12-17T22:55:33.337229178Z 62 PC: 8f0d1 | Close file
2018-12-17T22:55:33.341714333Z 75 PC: 8f0f2 | Execute program
2018-12-17T22:55:33.365112268Z 80 PC: 12be9 | Set current PSP
2018-12-17T22:55:33.366476474Z 48 PC: 12bee | Get DOS version
2018-12-17T22:55:33.369039965Z 99 PC: 193d0 | Get DBCS lead byte table pointer
2018-12-17T22:55:33.372618616Z 101 PC: 12c74 | Get extended country info
2018-12-17T22:55:33.374462133Z 99 PC: 12c7a | Get DBCS lead byte table pointer
2018-12-17T22:55:33.376725851Z 74 PC: 12cdc | Reallocate memory
2018-12-17T22:55:33.379080189Z 72 PC: 1355d | Allocate memory
2018-12-17T22:55:33.381195226Z 25 PC: 13596 | Get default drive
2018-12-17T22:55:33.383618233Z 71 PC: 135ad | Get current directory
2018-12-17T22:55:33.387067029Z 59 PC: 135ba | Change current directory
2018-12-17T22:55:33.393066864Z 59 PC: 135c8 | Change current directory
2018-12-17T22:55:33.399762917Z 59 PC: 135d3 | Change current directory
2018-12-17T22:55:33.404949501Z 25 PC: 12d13 | Get default drive
2018-12-17T22:55:33.406641624Z 37 PC: 127d3 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T22:55:33.408254737Z 37 PC: 127da | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:55:33.411818209Z 37 PC: 127e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:55:33.414241587Z 80 PC: 1301d | Set current PSP
2018-12-17T22:55:33.415310187Z 37 PC: 13041 | Set interrupt vector (Interrupt = '46' AKA 'Set verify flag')
2018-12-17T22:55:33.417882174Z 53 PC: 13362 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:55:33.419689884Z 37 PC: 13383 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:55:33.422273313Z 51 PC: 13417 | Get or set Ctrl-Break
2018-12-17T22:55:33.425048883Z 72 PC: 130ec | Allocate memory
2018-12-17T22:55:33.431252009Z 61 PC: 131b2 | Open file (Filename = '')
2018-12-17T22:55:33.438093526Z 62 PC: 131ba | Close file
2018-12-17T22:55:33.441438367Z 51 PC: 1344c | Get or set Ctrl-Break
2018-12-17T22:55:33.443110883Z 74 PC: 1197c | Reallocate memory
2018-12-17T22:55:33.444862487Z 72 PC: 11991 | Allocate memory
2018-12-17T22:55:33.447720291Z 73 PC: 119b2 | Release memory
2018-12-17T22:55:33.449287178Z 72 PC: 119bd | Allocate memory
2018-12-17T22:55:33.451210085Z 73 PC: 119df | Release memory
2018-12-17T22:55:33.45389841Z 72 PC: 119f5 | Allocate memory
2018-12-17T22:55:33.455906898Z 72 PC: 119fd | Allocate memory