Sample viewer

vx.netlux.org/Virus.DOS.Debo.a

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:57:37.075879424Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:57:37.078005551Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:57:37.07985623Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:57:37.081591211Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:57:37.083870617Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:57:37.086275778Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:57:37.08821296Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:57:37.089917044Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:57:37.092666462Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:57:37.094812215Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:57:37.096501762Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:57:37.099215183Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:57:37.100902644Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:57:37.10252824Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:57:37.114263231Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:57:37.115769472Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:57:37.117297194Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:57:37.119392984Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:57:37.121363588Z 53 PC: 13cf2 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:57:37.123165335Z 37 PC: 13d07 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:57:37.125635158Z 37 PC: 13d0f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:57:37.127553895Z 37 PC: 13d17 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:57:37.129234003Z 37 PC: 13d1f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:57:37.131387311Z 68 PC: 1408f | I/O control for devices (Set for = '')
2018-12-17T22:57:37.206475055Z 37 PC: 13715 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:57:37.208593167Z 44 PC: 1492f | Get time 0x1492f: mov word ptr [0x3e], cx
0x14933: mov word ptr [0x40], dx
0x14937: retf
0x14938: push bp
0x14939: mov bp, sp
0x1493b: mov dx, word ptr [bp + 6]
0x1493e: or dx, dx
0x14940: je 0x14947
0x14942: call 0x1498e
0x14945: jmp 0x14977
0x14947: mov ah, 0x30
0x14949: int 0x21
0x1494b: cmp al, 3
0x1494d: mov ax, 0
0x14950: jb 0x14977
0x14952: mov es, word ptr [0x38]
0x14956: mov es, word ptr es:[0x2c]
0x1495b: xor di, di
0x1495d: cld
0x1495e: cmp al, byte ptr es:[di]
2018-12-17T22:57:37.211391698Z 44 PC: 1492f | Get time 0x1492f: mov word ptr [0x3e], cx
0x14933: mov word ptr [0x40], dx
0x14937: retf
0x14938: push bp
0x14939: mov bp, sp
0x1493b: mov dx, word ptr [bp + 6]
0x1493e: or dx, dx
0x14940: je 0x14947
0x14942: call 0x1498e
0x14945: jmp 0x14977
0x14947: mov ah, 0x30
0x14949: int 0x21
0x1494b: cmp al, 3
0x1494d: mov ax, 0
0x14950: jb 0x14977
0x14952: mov es, word ptr [0x38]
0x14956: mov es, word ptr es:[0x2c]
0x1495b: xor di, di
0x1495d: cld
0x1495e: cmp al, byte ptr es:[di]
2018-12-17T22:57:37.214905524Z 48 PC: 1494b | Get DOS version
2018-12-17T22:57:37.21723899Z 67 PC: 1350b | Get or set file attributes
2018-12-17T22:57:37.225648299Z 26 PC: 133b7 | Set disk transfer address
2018-12-17T22:57:37.228245751Z 78 PC: 133c3 | Find first file
2018-12-17T22:57:37.231770237Z 26 PC: 133b7 | Set disk transfer address
2018-12-17T22:57:37.233377699Z 78 PC: 133c3 | Find first file
2018-12-17T22:57:37.23768194Z 26 PC: 133b7 | Set disk transfer address
2018-12-17T22:57:37.239305682Z 78 PC: 133c3 | Find first file
2018-12-17T22:57:37.242631574Z 26 PC: 133b7 | Set disk transfer address
2018-12-17T22:57:37.245203539Z 78 PC: 133c3 | Find first file
2018-12-17T22:57:37.254447837Z 26 PC: 133b7 | Set disk transfer address
2018-12-17T22:57:37.255790361Z 78 PC: 133c3 | Find first file
2018-12-17T22:57:37.258767958Z 26 PC: 133b7 | Set disk transfer address
2018-12-17T22:57:37.260858438Z 78 PC: 133c3 | Find first file
2018-12-17T22:57:37.275766163Z 26 PC: 133b7 | Set disk transfer address
2018-12-17T22:57:37.277393222Z 78 PC: 133c3 | Find first file
2018-12-17T22:57:37.28531348Z 26 PC: 133b7 | Set disk transfer address
2018-12-17T22:57:37.286799824Z 78 PC: 133c3 | Find first file
2018-12-17T22:57:37.293070072Z 26 PC: 133b7 | Set disk transfer address
2018-12-17T22:57:37.29540481Z 78 PC: 133c3 | Find first file
2018-12-17T22:57:37.30138382Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.302883409Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.307012251Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.308547507Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.316808196Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.32051822Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.327638335Z 26 PC: 133b7 | Set disk transfer address
2018-12-17T22:57:37.329191335Z 78 PC: 133c3 | Find first file
2018-12-17T22:57:37.34084428Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$TTRIB.EXE')
2018-12-17T22:57:37.352700238Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.354173487Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.358692442Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$HKDSK.EXE')
2018-12-17T22:57:37.367478248Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.369072996Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.373620454Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$EBUG.EXE')
2018-12-17T22:57:37.382444592Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.383990749Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.388490729Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$XPAND.EXE')
2018-12-17T22:57:37.397074305Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.398599642Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.403109971Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$DISK.EXE')
2018-12-17T22:57:37.412075885Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.4139882Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.419418759Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$EM.EXE')
2018-12-17T22:57:37.427107322Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.429770428Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.434368091Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$LSFUNC.EXE')
2018-12-17T22:57:37.442173734Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.444832603Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.449400009Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$BASIC.EXE')
2018-12-17T22:57:37.457398676Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.459752821Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.464640189Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$EPLACE.EXE')
2018-12-17T22:57:37.472315557Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.474602065Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.479535339Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$ESTORE.EXE')
2018-12-17T22:57:37.488089129Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.489602534Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.495604437Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$CANDISK.EXE')
2018-12-17T22:57:37.503630625Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.504941258Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.510260649Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$ETUP.EXE')
2018-12-17T22:57:37.517762862Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.519072083Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.527327692Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$COPY.EXE')
2018-12-17T22:57:37.535551682Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.536940623Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.542278237Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$EFRAG.EXE')
2018-12-17T22:57:37.5508872Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.55283394Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.558701741Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$MM386.EXE')
2018-12-17T22:57:37.56796247Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.569849958Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.574764456Z 61 PC: 14076 | Open file (Filename = 'c:\DOS\$SCDEX.EXE')
2018-12-17T22:57:37.58402227Z 26 PC: 133db | Set disk transfer address
2018-12-17T22:57:37.585863541Z 79 PC: 133e0 | Find next file
2018-12-17T22:57:37.590780334Z 53 PC: 1341e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:57:37.593909105Z 37 PC: 13427 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:57:37.595659165Z 53 PC: 1341e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:57:37.597249114Z 37 PC: 13427 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:57:37.599849402Z 53 PC: 1341e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:57:37.601749043Z 37 PC: 13427 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:57:37.603568153Z 53 PC: 1341e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:57:37.60650341Z 37 PC: 13427 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:57:37.61126396Z 53 PC: 1341e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:57:37.613095072Z 37 PC: 13427 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:57:37.616034969Z 53 PC: 1341e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:57:37.617936573Z 37 PC: 13427 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:57:37.619736778Z 53 PC: 1341e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:57:37.621622333Z 37 PC: 13427 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:57:37.624531671Z 53 PC: 1341e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:57:37.626427766Z 37 PC: 13427 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:57:37.628236877Z 53 PC: 1341e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:57:37.630978761Z 37 PC: 13427 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:57:37.633160061Z 53 PC: 1341e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:57:37.635016932Z 37 PC: 13427 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:57:37.637379534Z 53 PC: 1341e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:57:37.638995361Z 37 PC: 13427 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:57:37.640243858Z 53 PC: 1341e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:57:37.641982787Z 37 PC: 13427 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:57:37.64363875Z 53 PC: 1341e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:57:37.645279755Z 37 PC: 13427 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:57:37.648034944Z 53 PC: 1341e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:57:37.650913155Z 37 PC: 13427 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:57:37.652784402Z 53 PC: 1341e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:57:37.654679615Z 37 PC: 13427 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:57:37.657590697Z 53 PC: 1341e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:57:37.659470481Z 37 PC: 13427 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:57:37.661311522Z 53 PC: 1341e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:57:37.664356666Z 37 PC: 13427 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:57:37.666225089Z 53 PC: 1341e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:57:37.667843Z 37 PC: 13427 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:57:37.670339563Z 53 PC: 1341e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:57:37.671870702Z 37 PC: 13427 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:57:37.674042314Z 41 PC: 134a7 | Parse filename
2018-12-17T22:57:37.676700261Z 41 PC: 134b5 | Parse filename
2018-12-17T22:57:37.678432437Z 75 PC: 134c0 | Execute program
2018-12-17T22:57:37.706885725Z 80 PC: 18be9 | Set current PSP
2018-12-17T22:57:37.709321914Z 48 PC: 18bee | Get DOS version
2018-12-17T22:57:37.712018333Z 99 PC: 1f3d0 | Get DBCS lead byte table pointer
2018-12-17T22:57:37.71545276Z 101 PC: 18c74 | Get extended country info
2018-12-17T22:57:37.718150641Z 99 PC: 18c7a | Get DBCS lead byte table pointer
2018-12-17T22:57:37.720400681Z 74 PC: 18cdc | Reallocate memory
2018-12-17T22:57:37.722527589Z 25 PC: 18d13 | Get default drive
2018-12-17T22:57:37.725343743Z 37 PC: 187d3 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T22:57:37.727233456Z 37 PC: 187da | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:57:37.728789811Z 37 PC: 187e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:57:37.735887303Z 74 PC: 1797c | Reallocate memory
2018-12-17T22:57:37.737693639Z 72 PC: 179bd | Allocate memory
2018-12-17T22:57:37.740134979Z 72 PC: 179f5 | Allocate memory
2018-12-17T22:57:37.742606455Z 72 PC: 179fd | Allocate memory