Sample viewer

vx.netlux.org/Virus.DOS.Vienna.DearUser.1542

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:56:28.504792621Z 48 PC: 13a34 | Get DOS version
2018-12-17T22:56:28.506769012Z 47 PC: 13a75 | Get disk transfer address
2018-12-17T22:56:28.508445451Z 26 PC: 13a84 | Set disk transfer address
2018-12-17T22:56:28.510213732Z 78 PC: 13b0b | Find first file
2018-12-17T22:56:28.517290542Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.521165746Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.524419237Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.527665365Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.532502343Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.536621783Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.539805057Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.544106641Z 78 PC: 13b0b | Find first file
2018-12-17T22:56:28.55437797Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.558074074Z 67 PC: 13b66 | Get or set file attributes
2018-12-17T22:56:28.566272028Z 67 PC: 13b76 | Get or set file attributes
2018-12-17T22:56:28.908253629Z 61 PC: 13b80 | Open file (Filename = 'C:\DOS\FORMAT.COM')
2018-12-17T22:56:28.915860611Z 87 PC: 13b8f | Get or set file date and time
2018-12-17T22:56:28.917637512Z 44 PC: 13b99 | Get time 0x13b99: mov cx, 3
0x13b9c: mov ah, 0x3f
0x13b9e: mov dx, 0xa
0x13ba1: add dx, si
0x13ba3: push dx
0x13ba4: int 0x21
0x13ba6: pop bp
0x13ba7: jb 0x13bcd
0x13ba9: cmp byte ptr [bp], 0x4d
0x13bad: jne 0x13bbb
0x13baf: cmp byte ptr [bp + 1], 0x5a
0x13bb3: je 0x13bcd
0x13bb5: jmp 0x13bbb
0x13bb7: jmp 0x13c09
0x13bb9: jmp 0x13c07
0x13bbb: cmp ax, 3
0x13bbe: jne 0x13c0b
0x13bc0: xor cx, cx
0x13bc2: mov ax, 0x4202
0x13bc5: xor dx, dx
2018-12-17T22:56:28.920571225Z 63 PC: 13ba6 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:56:28.926562533Z 66 PC: 13bc9 | Move file pointer
2018-12-17T22:56:28.928253557Z 64 PC: 13c22 | Write file or device (Write 1542 bytes on handle 5)
2018-12-17T22:56:28.937945029Z 66 PC: 13c32 | Move file pointer
2018-12-17T22:56:28.939500574Z 64 PC: 13c40 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:56:28.942578774Z 87 PC: 13c51 | Get or set file date and time
2018-12-17T22:56:28.944604708Z 62 PC: 13c55 | Close file
2018-12-17T22:56:28.951980387Z 67 PC: 13c62 | Get or set file attributes
2018-12-17T22:56:28.962504321Z 26 PC: 13c6c | Set disk transfer address
2018-12-17T22:56:28.964700126Z 47 PC: 13a75 | Get disk transfer address
2018-12-17T22:56:28.965848183Z 26 PC: 13a84 | Set disk transfer address
2018-12-17T22:56:28.967228106Z 78 PC: 13b0b | Find first file
2018-12-17T22:56:28.974452427Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.977233413Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.979964795Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.982919395Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.986013902Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.98878968Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.991675745Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:28.99457913Z 78 PC: 13b0b | Find first file
2018-12-17T22:56:29.002367367Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.005617529Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.009249748Z 67 PC: 13b66 | Get or set file attributes
2018-12-17T22:56:29.016019611Z 67 PC: 13b76 | Get or set file attributes
2018-12-17T22:56:29.026915531Z 61 PC: 13b80 | Open file (Filename = 'C:\DOS\KEYB.COM')
2018-12-17T22:56:29.035642997Z 87 PC: 13b8f | Get or set file date and time
2018-12-17T22:56:29.037517353Z 44 PC: 13b99 | Get time 0x13b99: mov cx, 3
0x13b9c: mov ah, 0x3f
0x13b9e: mov dx, 0xa
0x13ba1: add dx, si
0x13ba3: push dx
0x13ba4: int 0x21
0x13ba6: pop bp
0x13ba7: jb 0x13bcd
0x13ba9: cmp byte ptr [bp], 0x4d
0x13bad: jne 0x13bbb
0x13baf: cmp byte ptr [bp + 1], 0x5a
0x13bb3: je 0x13bcd
0x13bb5: jmp 0x13bbb
0x13bb7: jmp 0x13c09
0x13bb9: jmp 0x13c07
0x13bbb: cmp ax, 3
0x13bbe: jne 0x13c0b
0x13bc0: xor cx, cx
0x13bc2: mov ax, 0x4202
0x13bc5: xor dx, dx
2018-12-17T22:56:29.040227859Z 63 PC: 13ba6 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:56:29.047079353Z 66 PC: 13bc9 | Move file pointer
2018-12-17T22:56:29.049268236Z 64 PC: 13c22 | Write file or device (Write 1542 bytes on handle 5)
2018-12-17T22:56:29.060546665Z 66 PC: 13c32 | Move file pointer
2018-12-17T22:56:29.06330456Z 64 PC: 13c40 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:56:29.06628055Z 87 PC: 13c51 | Get or set file date and time
2018-12-17T22:56:29.067739342Z 62 PC: 13c55 | Close file
2018-12-17T22:56:29.075772435Z 67 PC: 13c62 | Get or set file attributes
2018-12-17T22:56:29.086289631Z 26 PC: 13c6c | Set disk transfer address
2018-12-17T22:56:29.087594922Z 47 PC: 13a75 | Get disk transfer address
2018-12-17T22:56:29.089619439Z 26 PC: 13a84 | Set disk transfer address
2018-12-17T22:56:29.090902434Z 78 PC: 13b0b | Find first file
2018-12-17T22:56:29.097290351Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.099948131Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.102709317Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.105178863Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.10785133Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.111120278Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.113872005Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.116572853Z 78 PC: 13b0b | Find first file
2018-12-17T22:56:29.12483581Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.129101858Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.131647226Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.136905681Z 67 PC: 13b66 | Get or set file attributes
2018-12-17T22:56:29.141217063Z 67 PC: 13b76 | Get or set file attributes
2018-12-17T22:56:29.151963491Z 61 PC: 13b80 | Open file (Filename = 'C:\DOS\SYS.COM')
2018-12-17T22:56:29.160116415Z 87 PC: 13b8f | Get or set file date and time
2018-12-17T22:56:29.161593909Z 44 PC: 13b99 | Get time 0x13b99: mov cx, 3
0x13b9c: mov ah, 0x3f
0x13b9e: mov dx, 0xa
0x13ba1: add dx, si
0x13ba3: push dx
0x13ba4: int 0x21
0x13ba6: pop bp
0x13ba7: jb 0x13bcd
0x13ba9: cmp byte ptr [bp], 0x4d
0x13bad: jne 0x13bbb
0x13baf: cmp byte ptr [bp + 1], 0x5a
0x13bb3: je 0x13bcd
0x13bb5: jmp 0x13bbb
0x13bb7: jmp 0x13c09
0x13bb9: jmp 0x13c07
0x13bbb: cmp ax, 3
0x13bbe: jne 0x13c0b
0x13bc0: xor cx, cx
0x13bc2: mov ax, 0x4202
0x13bc5: xor dx, dx
2018-12-17T22:56:29.163796387Z 63 PC: 13ba6 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:56:29.170397678Z 66 PC: 13bc9 | Move file pointer
2018-12-17T22:56:29.172121252Z 64 PC: 13c22 | Write file or device (Write 1542 bytes on handle 5)
2018-12-17T22:56:29.181135237Z 66 PC: 13c32 | Move file pointer
2018-12-17T22:56:29.18267664Z 64 PC: 13c40 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:56:29.185830668Z 87 PC: 13c51 | Get or set file date and time
2018-12-17T22:56:29.187712739Z 62 PC: 13c55 | Close file
2018-12-17T22:56:29.19713148Z 67 PC: 13c62 | Get or set file attributes
2018-12-17T22:56:29.208230847Z 26 PC: 13c6c | Set disk transfer address
2018-12-17T22:56:29.20939196Z 47 PC: 13a75 | Get disk transfer address
2018-12-17T22:56:29.2117371Z 26 PC: 13a84 | Set disk transfer address
2018-12-17T22:56:29.213018497Z 78 PC: 13b0b | Find first file
2018-12-17T22:56:29.219660877Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.222328173Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.22504496Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.228270137Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.23153228Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.234880712Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.237728714Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.24053572Z 78 PC: 13b0b | Find first file
2018-12-17T22:56:29.249167345Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.253475713Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.25750423Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.263314036Z 79 PC: 13b15 | Find next file
2018-12-17T22:56:29.270898516Z 26 PC: 13c6c | Set disk transfer address
2018-12-17T22:56:29.272191446Z 22 PC: 13ced | Create or truncate file
2018-12-17T22:56:29.274990554Z 9 PC: 13908 | Display string (String= 'Goat file (COM/b...). Size=00000FA0h/0000004000d bytes. ')
2018-12-17T22:56:29.281488958Z 48 PC: 13911 | Get DOS version
2018-12-17T22:56:29.282798228Z 61 PC: 139de | Open file (Filename = '')
2018-12-17T22:56:29.29141293Z 93 PC: 13980 | File sharing functions
2018-12-17T22:56:29.29339947Z 9 PC: 13908 | Display string (String= 'Size change=0626h/01574d. ')
2018-12-17T22:56:29.297916274Z 76 PC: 13965 | Terminate with return code (Return code = '1')