Sample viewer

vx.netlux.org/Virus.DOS.Vienna.648.n

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:57:44.681132207Z 48 PC: 12ba6 | Get DOS version
2018-12-17T22:57:44.682334003Z 47 PC: 12bb2 | Get disk transfer address
2018-12-17T22:57:44.683341156Z 26 PC: 12bc5 | Set disk transfer address
2018-12-17T22:57:44.684133398Z 78 PC: 12c4f | Find first file
2018-12-17T22:57:44.687951715Z 67 PC: 12c8f | Get or set file attributes
2018-12-17T22:57:44.691831177Z 67 PC: 12ca2 | Get or set file attributes
2018-12-17T22:57:44.70447515Z 61 PC: 12cad | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:57:44.70878966Z 87 PC: 12cb9 | Get or set file date and time
2018-12-17T22:57:44.710308297Z 44 PC: 12cc5 | Get time 0x12cc5: and dh, 7
0x12cc8: jne 0x12cda
0x12cca: mov ah, 0x40
0x12ccc: mov cx, 5
0x12ccf: mov dx, si
0x12cd1: add dx, 0x8a
0x12cd5: int 0x21
0x12cd7: jmp 0x12d3e
0x12cd9: nop
0x12cda: mov ah, 0x3f
0x12cdc: mov cx, 3
0x12cdf: mov dx, 0xa
0x12ce2: nop
0x12ce3: add dx, si
0x12ce5: int 0x21
0x12ce7: jb 0x12d3e
0x12ce9: cmp ax, 3
0x12cec: jne 0x12d3e
0x12cee: mov ax, 0x4202
0x12cf1: mov cx, 0
2018-12-17T22:57:44.711878059Z 64 PC: 12cd7 | Write file or device (Write 5 bytes on handle 5)
2018-12-17T22:57:44.716132315Z 87 PC: 12d53 | Get or set file date and time
2018-12-17T22:57:44.723208966Z 62 PC: 12d57 | Close file
2018-12-17T22:57:44.740543735Z 67 PC: 12d66 | Get or set file attributes
2018-12-17T22:57:44.753745076Z 26 PC: 12d73 | Set disk transfer address
2018-12-17T22:57:44.762925964Z 9 PC: 12a82 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-17T22:57:44.770070166Z 76 PC: 12a86 | Terminate with return code (Return code = '36')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":12653,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:35:48.776515402Z 48 PC: 12ba6 | Get DOS version
2018-12-25T12:35:48.777933439Z 47 PC: 12bb2 | Get disk transfer address
2018-12-25T12:35:48.77919502Z 26 PC: 12bc5 | Set disk transfer address
2018-12-25T12:35:48.780414776Z 78 PC: 12c4f | Find first file
2018-12-25T12:35:48.787258527Z 67 PC: 12c8f | Get or set file attributes
2018-12-25T12:35:48.794096602Z 67 PC: 12ca2 | Get or set file attributes
2018-12-25T12:35:48.874535844Z 61 PC: 12cad | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:35:48.882475058Z 87 PC: 12cb9 | Get or set file date and time
2018-12-25T12:35:48.885643538Z 44 PC: 12cc5 | Get time 0x12cc5: and dh, 7
0x12cc8: jne 0x12cda
0x12cca: mov ah, 0x40
0x12ccc: mov cx, 5
0x12ccf: mov dx, si
0x12cd1: add dx, 0x8a
0x12cd5: int 0x21
0x12cd7: jmp 0x12d3e
0x12cd9: nop
0x12cda: mov ah, 0x3f
0x12cdc: mov cx, 3
0x12cdf: mov dx, 0xa
0x12ce2: nop
0x12ce3: add dx, si
0x12ce5: int 0x21
0x12ce7: jb 0x12d3e
0x12ce9: cmp ax, 3
0x12cec: jne 0x12d3e
0x12cee: mov ax, 0x4202
0x12cf1: mov cx, 0
2018-12-25T12:35:48.888148565Z 63 PC: 12ce7 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:35:48.896587382Z 66 PC: 12cf9 | Move file pointer
2018-12-25T12:35:48.902000007Z 64 PC: 12d1d | Write file or device (Write 648 bytes on handle 5)
2018-12-25T12:35:48.911666225Z 66 PC: 12d2f | Move file pointer
2018-12-25T12:35:48.913662032Z 64 PC: 12d3e | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:35:48.922260114Z 87 PC: 12d53 | Get or set file date and time
2018-12-25T12:35:48.924565823Z 62 PC: 12d57 | Close file
2018-12-25T12:35:48.93372896Z 67 PC: 12d66 | Get or set file attributes
2018-12-25T12:35:48.945121313Z 26 PC: 12d73 | Set disk transfer address
2018-12-25T12:35:48.948030178Z 9 PC: 12a82 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-25T12:35:48.954472306Z 76 PC: 12a86 | Terminate with return code (Return code = '36')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":7,"TimeBased":true,"OriginalID":12653,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:35:48.807762364Z 48 PC: 12ba6 | Get DOS version
2018-12-25T12:35:48.808940396Z 47 PC: 12bb2 | Get disk transfer address
2018-12-25T12:35:48.81056441Z 26 PC: 12bc5 | Set disk transfer address
2018-12-25T12:35:48.8120522Z 78 PC: 12c4f | Find first file
2018-12-25T12:35:48.818780185Z 67 PC: 12c8f | Get or set file attributes
2018-12-25T12:35:48.825912095Z 67 PC: 12ca2 | Get or set file attributes
2018-12-25T12:35:48.874095105Z 61 PC: 12cad | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:35:48.883081069Z 87 PC: 12cb9 | Get or set file date and time
2018-12-25T12:35:48.899950077Z 44 PC: 12cc5 | Get time 0x12cc5: and dh, 7
0x12cc8: jne 0x12cda
0x12cca: mov ah, 0x40
0x12ccc: mov cx, 5
0x12ccf: mov dx, si
0x12cd1: add dx, 0x8a
0x12cd5: int 0x21
0x12cd7: jmp 0x12d3e
0x12cd9: nop
0x12cda: mov ah, 0x3f
0x12cdc: mov cx, 3
0x12cdf: mov dx, 0xa
0x12ce2: nop
0x12ce3: add dx, si
0x12ce5: int 0x21
0x12ce7: jb 0x12d3e
0x12ce9: cmp ax, 3
0x12cec: jne 0x12d3e
0x12cee: mov ax, 0x4202
0x12cf1: mov cx, 0
2018-12-25T12:35:48.909872323Z 63 PC: 12ce7 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:35:48.92114647Z 66 PC: 12cf9 | Move file pointer
2018-12-25T12:35:48.923609241Z 64 PC: 12d1d | Write file or device (Write 648 bytes on handle 5)
2018-12-25T12:35:48.946666498Z 66 PC: 12d2f | Move file pointer
2018-12-25T12:35:48.948462941Z 64 PC: 12d3e | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:35:48.955674787Z 87 PC: 12d53 | Get or set file date and time
2018-12-25T12:35:48.95865486Z 62 PC: 12d57 | Close file
2018-12-25T12:35:48.967437366Z 67 PC: 12d66 | Get or set file attributes
2018-12-25T12:35:48.978583939Z 26 PC: 12d73 | Set disk transfer address
2018-12-25T12:35:48.98089699Z 9 PC: 12a82 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-25T12:35:48.98786402Z 76 PC: 12a86 | Terminate with return code (Return code = '36')