Sample viewer

vx.netlux.org/Virus.DOS.I_Love_Dos.3622

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:59:10.110302586Z 77 PC: 17c03 | Get program return code
2018-12-17T22:59:10.112011536Z 98 PC: 18762 | Get current PSP
2018-12-17T22:59:10.112839588Z 61 PC: 1879a | Open file (Filename = 'C:\COMMAND.COM')
2018-12-17T22:59:10.118988124Z 62 PC: 187a3 | Close file
2018-12-17T22:59:10.121522113Z 82 PC: 185f6 | Get DOS internal pointers (SYSVARS)
2018-12-17T22:59:10.122842045Z 74 PC: 13523 | Reallocate memory
2018-12-17T22:59:10.124043683Z 42 PC: 1331f | Get date 0x1331f: mov cx, dx
0x13321: mov al, dh
0x13323: dec al
0x13325: xor ah, ah
0x13327: xor ch, ch
0x13329: xor dx, dx
0x1332b: mov bx, 0x1e
0x1332e: mul bx
0x13330: add ax, cx
0x13332: mov dx, ax
0x13334: mov ax, 0xffff
0x13337: mov ds, ax
0x13339: mov si, 5
0x1333c: mov di, 0xeb4
0x1333f: mov cx, 0xa
0x13342: repe cmpsb byte ptr [si], byte ptr es:[di]
0x13344: je 0x13366
0x13346: mov si, 5
0x13349: mov di, 0xeb4
0x1334c: mov cx, 0xa
2018-12-17T22:59:10.12667718Z 53 PC: 12a9d | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:10.128425671Z 75 PC: 12a9d | Execute program
2018-12-17T22:59:10.144695535Z 48 PC: 13bac | Get DOS version
2018-12-17T22:59:10.146949822Z 53 PC: 13cdc | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:10.14844297Z 53 PC: 13ce9 | Get interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T22:59:10.149945779Z 53 PC: 13cf6 | Get interrupt vector (Interrupt = '5' AKA 'Printer output')
2018-12-17T22:59:10.152578824Z 53 PC: 13d03 | Get interrupt vector (Interrupt = '6' AKA 'Direct console I/O')
2018-12-17T22:59:10.15472949Z 37 PC: 13d17 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:10.156907368Z 74 PC: 13c2f | Reallocate memory
2018-12-17T22:59:10.159988078Z 68 PC: 1525b | I/O control for devices (Set for = '��')
2018-12-17T22:59:10.162317254Z 74 PC: 1566e | Reallocate memory
2018-12-17T22:59:10.164563416Z 68 PC: 1525b | I/O control for devices (Set for = 'Turbo C++ - Copyright 1990 Borland Intl.')
2018-12-17T22:59:10.169385127Z 64 PC: 15c6c | Write file or device (Write 82 bytes on handle 2)
2018-12-17T22:59:10.177524668Z 64 PC: 15c6c | Write file or device (Write 82 bytes on handle 2)
2018-12-17T22:59:10.185998111Z 64 PC: 15c6c | Write file or device (Write 28 bytes on handle 2)
2018-12-17T22:59:10.191582913Z 37 PC: 13d23 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:10.193129605Z 37 PC: 13d2e | Set interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T22:59:10.194670757Z 37 PC: 13d39 | Set interrupt vector (Interrupt = '5' AKA 'Printer output')
2018-12-17T22:59:10.196338306Z 37 PC: 13d44 | Set interrupt vector (Interrupt = '6' AKA 'Direct console I/O')
2018-12-17T22:59:10.197784495Z 76 PC: 13ccd | Terminate with return code (Return code = '1')
2018-12-17T22:59:10.200608006Z 73 PC: 12a9d | Release memory
2018-12-17T22:59:10.202051547Z 49 PC: 12a9d | Terminate and stay resident (Return code = '0' | Memory size = '272')