Sample viewer

vx.netlux.org/Virus.DOS.Vienna.708

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:55:51.332000642Z 48 PC: 12ba6 | Get DOS version
2018-12-17T22:55:51.333876133Z 47 PC: 12bb2 | Get disk transfer address
2018-12-17T22:55:51.336128335Z 26 PC: 12bc5 | Set disk transfer address
2018-12-17T22:55:51.337674754Z 78 PC: 12c51 | Find first file
2018-12-17T22:55:51.344234154Z 67 PC: 12c8f | Get or set file attributes
2018-12-17T22:55:51.350616331Z 67 PC: 12ca2 | Get or set file attributes
2018-12-17T22:55:51.379691572Z 61 PC: 12cad | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:55:51.401767606Z 87 PC: 12cb9 | Get or set file date and time
2018-12-17T22:55:51.404732056Z 44 PC: 12cc5 | Get time 0x12cc5: and dh, 7
0x12cc8: jne 0x12cda
0x12cca: mov ah, 0x40
0x12ccc: mov cx, 0x3c
0x12ccf: mov dx, si
0x12cd1: add dx, 0x8f
0x12cd5: int 0x21
0x12cd7: jmp 0x12d3e
0x12cd9: nop
0x12cda: mov ah, 0x3f
0x12cdc: mov cx, 3
0x12cdf: mov dx, 0xa
0x12ce2: nop
0x12ce3: add dx, si
0x12ce5: int 0x21
0x12ce7: jb 0x12d3e
0x12ce9: cmp ax, 3
0x12cec: jne 0x12d3e
0x12cee: mov ax, 0x4202
0x12cf1: mov cx, 0
2018-12-17T22:55:51.406934984Z 63 PC: 12ce7 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:55:51.413455352Z 66 PC: 12cf9 | Move file pointer
2018-12-17T22:55:51.426302827Z 64 PC: 12d1d | Write file or device (Write 708 bytes on handle 5)
2018-12-17T22:55:51.434956153Z 66 PC: 12d2f | Move file pointer
2018-12-17T22:55:51.438435447Z 64 PC: 12d3e | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:55:51.461522811Z 87 PC: 12d53 | Get or set file date and time
2018-12-17T22:55:51.463980093Z 62 PC: 12d57 | Close file
2018-12-17T22:55:51.472361186Z 67 PC: 12d66 | Get or set file attributes
2018-12-17T22:55:51.48320205Z 26 PC: 12d73 | Set disk transfer address
2018-12-17T22:55:51.484451352Z 9 PC: 12a82 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-17T22:55:51.488429262Z 76 PC: 12a86 | Terminate with return code (Return code = '36')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":12030,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:31:51.137314829Z 48 PC: 12ba6 | Get DOS version
2018-12-25T12:31:51.138473988Z 47 PC: 12bb2 | Get disk transfer address
2018-12-25T12:31:51.140066683Z 26 PC: 12bc5 | Set disk transfer address
2018-12-25T12:31:51.141340965Z 78 PC: 12c51 | Find first file
2018-12-25T12:31:51.148098291Z 67 PC: 12c8f | Get or set file attributes
2018-12-25T12:31:51.155177211Z 67 PC: 12ca2 | Get or set file attributes
2018-12-25T12:31:51.273814934Z 61 PC: 12cad | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:31:51.281815727Z 87 PC: 12cb9 | Get or set file date and time
2018-12-25T12:31:51.288379237Z 44 PC: 12cc5 | Get time 0x12cc5: and dh, 7
0x12cc8: jne 0x12cda
0x12cca: mov ah, 0x40
0x12ccc: mov cx, 0x3c
0x12ccf: mov dx, si
0x12cd1: add dx, 0x8f
0x12cd5: int 0x21
0x12cd7: jmp 0x12d3e
0x12cd9: nop
0x12cda: mov ah, 0x3f
0x12cdc: mov cx, 3
0x12cdf: mov dx, 0xa
0x12ce2: nop
0x12ce3: add dx, si
0x12ce5: int 0x21
0x12ce7: jb 0x12d3e
0x12ce9: cmp ax, 3
0x12cec: jne 0x12d3e
0x12cee: mov ax, 0x4202
0x12cf1: mov cx, 0
2018-12-25T12:31:51.297137503Z 63 PC: 12ce7 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:31:51.304847475Z 66 PC: 12cf9 | Move file pointer
2018-12-25T12:31:51.307071762Z 64 PC: 12d1d | Write file or device (Write 708 bytes on handle 5)
2018-12-25T12:31:51.318465116Z 66 PC: 12d2f | Move file pointer
2018-12-25T12:31:51.320177326Z 64 PC: 12d3e | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:31:51.333469128Z 87 PC: 12d53 | Get or set file date and time
2018-12-25T12:31:51.341025323Z 62 PC: 12d57 | Close file
2018-12-25T12:31:51.35029362Z 67 PC: 12d66 | Get or set file attributes
2018-12-25T12:31:51.361887756Z 26 PC: 12d73 | Set disk transfer address
2018-12-25T12:31:51.364244933Z 9 PC: 12a82 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-25T12:31:51.37161051Z 76 PC: 12a86 | Terminate with return code (Return code = '36')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":7,"TimeBased":true,"OriginalID":12030,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:31:52.170559703Z 48 PC: 12ba6 | Get DOS version
2018-12-25T12:31:52.172550076Z 47 PC: 12bb2 | Get disk transfer address
2018-12-25T12:31:52.174240241Z 26 PC: 12bc5 | Set disk transfer address
2018-12-25T12:31:52.175612993Z 78 PC: 12c51 | Find first file
2018-12-25T12:31:52.183080969Z 67 PC: 12c8f | Get or set file attributes
2018-12-25T12:31:52.190501685Z 67 PC: 12ca2 | Get or set file attributes
2018-12-25T12:31:52.209003714Z 61 PC: 12cad | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:31:52.220872979Z 87 PC: 12cb9 | Get or set file date and time
2018-12-25T12:31:52.222886147Z 44 PC: 12cc5 | Get time 0x12cc5: and dh, 7
0x12cc8: jne 0x12cda
0x12cca: mov ah, 0x40
0x12ccc: mov cx, 0x3c
0x12ccf: mov dx, si
0x12cd1: add dx, 0x8f
0x12cd5: int 0x21
0x12cd7: jmp 0x12d3e
0x12cd9: nop
0x12cda: mov ah, 0x3f
0x12cdc: mov cx, 3
0x12cdf: mov dx, 0xa
0x12ce2: nop
0x12ce3: add dx, si
0x12ce5: int 0x21
0x12ce7: jb 0x12d3e
0x12ce9: cmp ax, 3
0x12cec: jne 0x12d3e
0x12cee: mov ax, 0x4202
0x12cf1: mov cx, 0
2018-12-25T12:31:52.22625838Z 63 PC: 12ce7 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:31:52.236803511Z 66 PC: 12cf9 | Move file pointer
2018-12-25T12:31:52.239414033Z 64 PC: 12d1d | Write file or device (Write 708 bytes on handle 5)
2018-12-25T12:31:52.248975337Z 66 PC: 12d2f | Move file pointer
2018-12-25T12:31:52.250834114Z 64 PC: 12d3e | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:31:52.258872343Z 87 PC: 12d53 | Get or set file date and time
2018-12-25T12:31:52.260793511Z 62 PC: 12d57 | Close file
2018-12-25T12:31:52.270174741Z 67 PC: 12d66 | Get or set file attributes
2018-12-25T12:31:52.281487828Z 26 PC: 12d73 | Set disk transfer address
2018-12-25T12:31:52.283589719Z 9 PC: 12a82 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-25T12:31:52.290697018Z 76 PC: 12a86 | Terminate with return code (Return code = '36')