Sample viewer

vx.netlux.org/Virus.DOS.Dreg.496

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:57:23.450450657Z 53 PC: 12a59 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:57:23.452634072Z 37 PC: 12a74 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:57:23.454093546Z 26 PC: 12a89 | Set disk transfer address
2018-12-17T22:57:23.455339237Z 78 PC: 12a9a | Find first file
2018-12-17T22:57:23.461861809Z 61 PC: 12aa5 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:57:23.469388188Z 63 PC: 12abe | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:57:23.476233427Z 62 PC: 12aec | Close file
2018-12-17T22:57:23.479540284Z 67 PC: 12afc | Get or set file attributes
2018-12-17T22:57:23.497871725Z 61 PC: 12b05 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:57:23.505055971Z 44 PC: 12c04 | Get time 0x12c04: pop di
0x12c05: push dx
0x12c06: push di
0x12c07: not ch
0x12c09: not ch
0x12c0b: ret
0x12c0c: lea si, word ptr [bp + 0x10b]
0x12c10: mov di, si
0x12c12: mov cx, 0xd3
0x12c15: lodsw ax, word ptr [si]
0x12c16: jmp 0x12c1c
0x12c18: stosw word ptr es:[di], ax
0x12c19: loop 0x12c15
0x12c1b: ret
0x12c1c: xor ah, byte ptr [bp + 0x2b7]
0x12c20: xor ax, word ptr [bp + 0x2b5]
0x12c24: xor ah, byte ptr [bp + 0x2b6]
0x12c28: xor ah, byte ptr [bp + 0x2b7]
0x12c2c: add al, 0
0x12c2e: xor ax, word ptr [bp + 0x2b7]
2018-12-17T22:57:23.507674103Z 44 PC: 12c04 | Get time 0x12c04: pop di
0x12c05: push dx
0x12c06: push di
0x12c07: not ch
0x12c09: not ch
0x12c0b: ret
0x12c0c: lea si, word ptr [bp + 0x10b]
0x12c10: mov di, si
0x12c12: mov cx, 0xd3
0x12c15: lodsw ax, word ptr [si]
0x12c16: jmp 0x12c1c
0x12c18: stosw word ptr es:[di], ax
0x12c19: loop 0x12c15
0x12c1b: ret
0x12c1c: xor ah, byte ptr [bp + 0x2b7]
0x12c20: xor ax, word ptr [bp + 0x2b5]
0x12c24: xor ah, byte ptr [bp + 0x2b6]
0x12c28: xor ah, byte ptr [bp + 0x2b7]
0x12c2c: add al, 0
0x12c2e: xor ax, word ptr [bp + 0x2b7]
2018-12-17T22:57:23.511031064Z 66 PC: 12c6d | Move file pointer
2018-12-17T22:57:23.512633787Z 64 PC: 12c8b | Write file or device (Write 496 bytes on handle 5)
2018-12-17T22:57:23.522780512Z 66 PC: 12c94 | Move file pointer
2018-12-17T22:57:23.526004723Z 64 PC: 12ca1 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:57:23.533927137Z 87 PC: 12b34 | Get or set file date and time
2018-12-17T22:57:23.53553481Z 62 PC: 12b38 | Close file
2018-12-17T22:57:23.543883986Z 67 PC: 12b47 | Get or set file attributes
2018-12-17T22:57:23.554664021Z 26 PC: 12b62 | Set disk transfer address
2018-12-17T22:57:23.555888663Z 37 PC: 12b73 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')