Sample viewer

vx.netlux.org/Virus.DOS.Coconut.1940

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-17T22:55:35.947550518Z	42	PC: 12aca \| Get date 0x12aca: jmp 0x12af1 0x12acc: dec ax 0x12acd: jns 0x12af1 0x12ad0: and byte ptr [si + 0x6f], cl 0x12ad3: outsw dx, word ptr [si] 0x12ad4: imul sp, word ptr [bx + si], 0x68 0x12ad7: jb 0x12b3f 0x12ada: and word ptr [bx + si], sp 0x12adc: pop cx 0x12add: outsw dx, word ptr [si] 0x12ade: jne 0x12b07 0x12ae0: jbe 0x12b47 0x12ae2: and byte ptr [bx + 0x6f], ah 0x12ae5: je 0x12b07 0x12ae7: popaw 0x12ae8: and byte ptr [bp + 0x69], dh 0x12aeb: jb 0x12b62 0x12aed: jae 0x12b10 0x12aef: and word ptr [bx + di], sp 0x12af1: pop bp
2018-12-17T22:55:35.950506858Z	71	PC: 12c2d \| Get current directory
2018-12-17T22:55:35.954605597Z	26	PC: 12c34 \| Set disk transfer address
2018-12-17T22:55:35.955939055Z	78	PC: 12b20 \| Find first file
2018-12-17T22:55:35.962484284Z	67	PC: 12b4d \| Get or set file attributes
2018-12-17T22:55:35.983969331Z	61	PC: 12b57 \| Open file (Filename = 'SLEEP.COM')
2018-12-17T22:55:35.991642662Z	63	PC: 12b64 \| Read file or device (Read 5 bytes on handle 5)
2018-12-17T22:55:35.999561205Z	66	PC: 12bec \| Move file pointer
2018-12-17T22:55:36.002128063Z	66	PC: 12b7f \| Move file pointer
2018-12-17T22:55:36.011398638Z	64	PC: 12b8b \| Write file or device (Write 5 bytes on handle 5)
2018-12-17T22:55:36.015429078Z	66	PC: 12bec \| Move file pointer
2018-12-17T22:55:36.017449587Z	44	PC: 12c51 \| Get time 0x12c51: cmp dx, 0 0x12c54: je 0x12c4e 0x12c56: mov word ptr ds:[bp + 0x896], dx 0x12c5b: ret 0x12c5c: sub cx, cx 0x12c5e: mov cl, byte ptr ds:[bp + 0x8ee] 0x12c63: lea dx, word ptr [bp + 0x8f7] 0x12c67: mov ax, 0x4301 0x12c6a: int3 0x12c6b: mov cx, word ptr ds:[bp + 0x8ef] 0x12c70: mov dx, word ptr ds:[bp + 0x8f1] 0x12c75: mov ax, 0x5701 0x12c78: int3 0x12c79: mov ah, 0x3e 0x12c7b: int3 0x12c7c: ret 0x12c7d: sub cx, cx 0x12c7f: mov dx, 0x314f 0x12c82: mov bx, 0x700 0x12c85: mov ax, 0x600
2018-12-17T22:55:36.022094132Z	64	PC: 12ba0 \| Write file or device (Write 1940 bytes on handle 5)
2018-12-17T22:55:36.032465478Z	67	PC: 12c6b \| Get or set file attributes
2018-12-17T22:55:36.044219815Z	87	PC: 12c79 \| Get or set file date and time
2018-12-17T22:55:36.046984113Z	62	PC: 12c7c \| Close file
2018-12-17T22:55:36.05478258Z	67	PC: 12c6b \| Get or set file attributes
2018-12-17T22:55:36.065603701Z	87	PC: 12c79 \| Get or set file date and time
2018-12-17T22:55:36.068454973Z	62	PC: 12c7c \| Close file
2018-12-17T22:55:36.070528232Z	79	PC: 12bd4 \| Find next file
2018-12-17T22:55:36.073673187Z	67	PC: 12c6b \| Get or set file attributes
2018-12-17T22:55:36.085253145Z	87	PC: 12c79 \| Get or set file date and time
2018-12-17T22:55:36.089400765Z	62	PC: 12c7c \| Close file
2018-12-17T22:55:36.091191573Z	79	PC: 12bd4 \| Find next file
2018-12-17T22:55:36.095875222Z	67	PC: 12c6b \| Get or set file attributes
2018-12-17T22:55:36.10817772Z	87	PC: 12c79 \| Get or set file date and time
2018-12-17T22:55:36.110233366Z	62	PC: 12c7c \| Close file
2018-12-17T22:55:36.112094276Z	79	PC: 12bd4 \| Find next file
2018-12-17T22:55:36.116517314Z	67	PC: 12c6b \| Get or set file attributes
2018-12-17T22:55:36.127712108Z	87	PC: 12c79 \| Get or set file date and time
2018-12-17T22:55:36.130001704Z	62	PC: 12c7c \| Close file
2018-12-17T22:55:36.133320265Z	79	PC: 12bd4 \| Find next file
2018-12-17T22:55:36.137029911Z	67	PC: 12c6b \| Get or set file attributes
2018-12-17T22:55:36.161054254Z	87	PC: 12c79 \| Get or set file date and time
2018-12-17T22:55:36.163999383Z	62	PC: 12c7c \| Close file
2018-12-17T22:55:36.165916719Z	79	PC: 12bd4 \| Find next file
2018-12-17T22:55:36.169097832Z	67	PC: 12b4d \| Get or set file attributes
2018-12-17T22:55:36.18682977Z	61	PC: 12b57 \| Open file (Filename = 'MANDEL.COM')
2018-12-17T22:55:36.195041243Z	63	PC: 12b64 \| Read file or device (Read 5 bytes on handle 5)
2018-12-17T22:55:36.210566802Z	66	PC: 12bec \| Move file pointer
2018-12-17T22:55:36.228396955Z	66	PC: 12b7f \| Move file pointer
2018-12-17T22:55:36.23035632Z	64	PC: 12b8b \| Write file or device (Write 5 bytes on handle 5)
2018-12-17T22:55:36.233558553Z	66	PC: 12bec \| Move file pointer
2018-12-17T22:55:36.235383134Z	44	PC: 12c51 \| Get time 0x12c51: cmp dx, 0 0x12c54: je 0x12c4e 0x12c56: mov word ptr ds:[bp + 0x896], dx 0x12c5b: ret 0x12c5c: sub cx, cx 0x12c5e: mov cl, byte ptr ds:[bp + 0x8ee] 0x12c63: lea dx, word ptr [bp + 0x8f7] 0x12c67: mov ax, 0x4301 0x12c6a: int3 0x12c6b: mov cx, word ptr ds:[bp + 0x8ef] 0x12c70: mov dx, word ptr ds:[bp + 0x8f1] 0x12c75: mov ax, 0x5701 0x12c78: int3 0x12c79: mov ah, 0x3e 0x12c7b: int3 0x12c7c: ret 0x12c7d: sub cx, cx 0x12c7f: mov dx, 0x314f 0x12c82: mov bx, 0x700 0x12c85: mov ax, 0x600
2018-12-17T22:55:36.239423583Z	64	PC: 12ba0 \| Write file or device (Write 1940 bytes on handle 5)
2018-12-17T22:55:36.254034031Z	67	PC: 12c6b \| Get or set file attributes
2018-12-17T22:55:36.276294385Z	87	PC: 12c79 \| Get or set file date and time
2018-12-17T22:55:36.279110181Z	62	PC: 12c7c \| Close file
2018-12-17T22:55:36.287738669Z	26	PC: 12bbc \| Set disk transfer address
2018-12-17T22:55:36.289252556Z	59	PC: 12bc3 \| Change current directory

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":11939,"SideJobID":0}

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:31:36.666157912Z	42	PC: 12aca \| Get date 0x12aca: jmp 0x12af1 0x12acc: dec ax 0x12acd: jns 0x12af1 0x12ad0: and byte ptr [si + 0x6f], cl 0x12ad3: outsw dx, word ptr [si] 0x12ad4: imul sp, word ptr [bx + si], 0x68 0x12ad7: jb 0x12b3f 0x12ada: and word ptr [bx + si], sp 0x12adc: pop cx 0x12add: outsw dx, word ptr [si] 0x12ade: jne 0x12b07 0x12ae0: jbe 0x12b47 0x12ae2: and byte ptr [bx + 0x6f], ah 0x12ae5: je 0x12b07 0x12ae7: popaw 0x12ae8: and byte ptr [bp + 0x69], dh 0x12aeb: jb 0x12b62 0x12aed: jae 0x12b10 0x12aef: and word ptr [bx + di], sp 0x12af1: pop bp
2018-12-25T12:31:36.673607272Z	9	PC: 12ca3 \| Display string (Could not find end pointer)
2018-12-25T12:31:36.694095918Z	76	PC: 12ca7 \| Terminate with return code (Return code = '36')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":1,"TimeBased":true,"OriginalID":11939,"SideJobID":0}

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:31:36.731948955Z	42	PC: 12aca \| Get date 0x12aca: jmp 0x12af1 0x12acc: dec ax 0x12acd: jns 0x12af1 0x12ad0: and byte ptr [si + 0x6f], cl 0x12ad3: outsw dx, word ptr [si] 0x12ad4: imul sp, word ptr [bx + si], 0x68 0x12ad7: jb 0x12b3f 0x12ada: and word ptr [bx + si], sp 0x12adc: pop cx 0x12add: outsw dx, word ptr [si] 0x12ade: jne 0x12b07 0x12ae0: jbe 0x12b47 0x12ae2: and byte ptr [bx + 0x6f], ah 0x12ae5: je 0x12b07 0x12ae7: popaw 0x12ae8: and byte ptr [bp + 0x69], dh 0x12aeb: jb 0x12b62 0x12aed: jae 0x12b10 0x12aef: and word ptr [bx + di], sp 0x12af1: pop bp
2018-12-25T12:31:36.74244251Z	9	PC: 12ca3 \| Display string (Could not find end pointer)
2018-12-25T12:31:36.762165914Z	76	PC: 12ca7 \| Terminate with return code (Return code = '36')