Sample viewer

vx.netlux.org/Virus.DOS.Xuxa.2058

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:59:19.601552495Z 120 PC: 1cd7f | UNKNOWN!
2018-12-17T22:59:19.603134567Z 74 PC: 1ce10 | Reallocate memory
2018-12-17T22:59:19.604412421Z 72 PC: 1ce16 | Allocate memory
2018-12-17T22:59:19.60606216Z 53 PC: 1ce38 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:59:19.60778659Z 37 PC: 1ce47 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:59:19.608907281Z 42 PC: 1ce4a | Get date 0x1ce4a: cmp cx, 0x7cd
0x1ce4e: jl 0x1ce5a
0x1ce50: cmp dl, 0x1b
0x1ce53: jne 0x1ce5a
0x1ce55: mov ax, 0x7870
0x1ce58: int 0x21
0x1ce5a: cmp byte ptr cs:[bp + 0x7ed], 0
0x1ce60: jne 0x1ce65
0x1ce62: jmp 0x1cd78
0x1ce65: jmp 0x1cd86
0x1ce68: pushf
0x1ce69: cmp ax, 0x4b00
0x1ce6c: je 0x1cecf
0x1ce6e: cmp ax, 0x7875
0x1ce71: je 0x1ceca
0x1ce73: cmp ax, 0x7870
0x1ce76: jne 0x1ce7b
0x1ce78: jmp 0x1d39c
0x1ce7b: cmp ah, 0x3e
0x1ce7e: mov byte ptr cs:[0x7ea], 1
2018-12-17T22:59:19.614483031Z 74 PC: 15215 | Reallocate memory
2018-12-17T22:59:19.616841559Z 48 PC: 1524d | Get DOS version
2018-12-17T22:59:19.618521174Z 53 PC: 14ece | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:59:19.619793206Z 37 PC: 14ee4 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:59:19.621809017Z 53 PC: 14ece | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:59:19.62321655Z 37 PC: 14ee4 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:59:19.624560968Z 53 PC: 14ece | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:59:19.62721592Z 37 PC: 14ee4 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:59:19.62887071Z 53 PC: 14ece | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:59:19.630563344Z 37 PC: 14ee4 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:59:19.637630394Z 53 PC: 14ece | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:59:19.639842362Z 37 PC: 14ee4 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:59:19.641904311Z 53 PC: 14ece | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:59:19.644339711Z 37 PC: 14ee4 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:59:19.645516096Z 53 PC: 14ece | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:59:19.646503167Z 37 PC: 14ee4 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:59:19.649054423Z 53 PC: 14ece | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:59:19.650388358Z 37 PC: 14ee4 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:59:19.651556004Z 53 PC: 14ece | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:59:19.653834469Z 37 PC: 14ee4 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:59:19.655119293Z 53 PC: 14ece | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:59:19.656436364Z 37 PC: 14ee4 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:59:19.659176028Z 74 PC: 1ac3b | Reallocate memory
2018-12-17T22:59:19.662550771Z 74 PC: 1ac3b | Reallocate memory
2018-12-17T22:59:19.665367403Z 74 PC: 1ac3b | Reallocate memory
2018-12-17T22:59:19.677656246Z 61 PC: 9eff9 | Open file
2018-12-17T22:59:19.682389215Z 54 PC: 14e9c | Get free disk space
2018-12-17T22:59:19.737959347Z 54 PC: 14e9c | Get free disk space

{"DateBased":true,"Day":27,"Month":1,"Year":1997,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13167,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:37:38.160400717Z 120 PC: 1cd7f | UNKNOWN!
2018-12-25T12:37:38.161691739Z 74 PC: 1ce10 | Reallocate memory
2018-12-25T12:37:38.162947059Z 72 PC: 1ce16 | Allocate memory
2018-12-25T12:37:38.164165956Z 53 PC: 1ce38 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:37:38.165660303Z 37 PC: 1ce47 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:37:38.166666772Z 42 PC: 1ce4a | Get date 0x1ce4a: cmp cx, 0x7cd
0x1ce4e: jl 0x1ce5a
0x1ce50: cmp dl, 0x1b
0x1ce53: jne 0x1ce5a
0x1ce55: mov ax, 0x7870
0x1ce58: int 0x21
0x1ce5a: cmp byte ptr cs:[bp + 0x7ed], 0
0x1ce60: jne 0x1ce65
0x1ce62: jmp 0x1cd78
0x1ce65: jmp 0x1cd86
0x1ce68: pushf
0x1ce69: cmp ax, 0x4b00
0x1ce6c: je 0x1cecf
0x1ce6e: cmp ax, 0x7875
0x1ce71: je 0x1ceca
0x1ce73: cmp ax, 0x7870
0x1ce76: jne 0x1ce7b
0x1ce78: jmp 0x1d39c
0x1ce7b: cmp ah, 0x3e
0x1ce7e: mov byte ptr cs:[0x7ea], 1

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13167,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:37:38.334350604Z 120 PC: 1cd7f | UNKNOWN!
2018-12-25T12:37:38.335235672Z 74 PC: 1ce10 | Reallocate memory
2018-12-25T12:37:38.336124904Z 72 PC: 1ce16 | Allocate memory
2018-12-25T12:37:38.337257871Z 53 PC: 1ce38 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:37:38.338461102Z 37 PC: 1ce47 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:37:38.339152618Z 42 PC: 1ce4a | Get date 0x1ce4a: cmp cx, 0x7cd
0x1ce4e: jl 0x1ce5a
0x1ce50: cmp dl, 0x1b
0x1ce53: jne 0x1ce5a
0x1ce55: mov ax, 0x7870
0x1ce58: int 0x21
0x1ce5a: cmp byte ptr cs:[bp + 0x7ed], 0
0x1ce60: jne 0x1ce65
0x1ce62: jmp 0x1cd78
0x1ce65: jmp 0x1cd86
0x1ce68: pushf
0x1ce69: cmp ax, 0x4b00
0x1ce6c: je 0x1cecf
0x1ce6e: cmp ax, 0x7875
0x1ce71: je 0x1ceca
0x1ce73: cmp ax, 0x7870
0x1ce76: jne 0x1ce7b
0x1ce78: jmp 0x1d39c
0x1ce7b: cmp ah, 0x3e
0x1ce7e: mov byte ptr cs:[0x7ea], 1
2018-12-25T12:37:38.344968652Z 74 PC: 15215 | Reallocate memory
2018-12-25T12:37:38.346256601Z 48 PC: 1524d | Get DOS version
2018-12-25T12:37:38.347778855Z 53 PC: 14ece | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-25T12:37:38.348916049Z 37 PC: 14ee4 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-25T12:37:38.350135054Z 53 PC: 14ece | Get interrupt vector (See above)
2018-12-25T12:37:38.351072403Z 37 PC: 14ee4 | Set interrupt vector (See above)
2018-12-25T12:37:38.352067901Z 53 PC: 14ece | Get interrupt vector (See above)
2018-12-25T12:37:38.35332886Z 37 PC: 14ee4 | Set interrupt vector (See above)
2018-12-25T12:37:38.354146644Z 53 PC: 14ece | Get interrupt vector (See above)
2018-12-25T12:37:38.355169352Z 37 PC: 14ee4 | Set interrupt vector (See above)
2018-12-25T12:37:38.356280249Z 53 PC: 14ece | Get interrupt vector (See above)
2018-12-25T12:37:38.357323371Z 37 PC: 14ee4 | Set interrupt vector (See above)
2018-12-25T12:37:38.35825957Z 53 PC: 14ece | Get interrupt vector (See above)
2018-12-25T12:37:38.359811677Z 37 PC: 14ee4 | Set interrupt vector (See above)
2018-12-25T12:37:38.360978817Z 53 PC: 14ece | Get interrupt vector (See above)
2018-12-25T12:37:38.362286681Z 37 PC: 14ee4 | Set interrupt vector (See above)
2018-12-25T12:37:38.36372324Z 53 PC: 14ece | Get interrupt vector (See above)
2018-12-25T12:37:38.364883743Z 37 PC: 14ee4 | Set interrupt vector (See above)
2018-12-25T12:37:38.366165445Z 53 PC: 14ece | Get interrupt vector (See above)
2018-12-25T12:37:38.367454591Z 37 PC: 14ee4 | Set interrupt vector (See above)
2018-12-25T12:37:38.368319378Z 53 PC: 14ece | Get interrupt vector (See above)
2018-12-25T12:37:38.369316Z 37 PC: 14ee4 | Set interrupt vector (See above)
2018-12-25T12:37:38.37104863Z 74 PC: 1ac3b | Reallocate memory
2018-12-25T12:37:38.372632339Z 74 PC: 1ac3b | Reallocate memory (See above)
2018-12-25T12:37:38.374498808Z 74 PC: 1ac3b | Reallocate memory (See above)
2018-12-25T12:37:38.386332593Z 61 PC: 9eff9 | Open file
2018-12-25T12:37:38.392827285Z 54 PC: 14e9c | Get free disk space
2018-12-25T12:37:38.437624179Z 54 PC: 14e9c | Get free disk space (See above)

{"DateBased":true,"Day":1,"Month":1,"Year":1997,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13167,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:37:38.14083244Z 64 PC: 0 | Write file or device (Write 2 bytes on handle 1)
2018-12-25T12:37:38.147603264Z 41 PC: 94fae | Parse filename
2018-12-25T12:37:38.15092643Z 41 PC: 9502f | Parse filename
2018-12-25T12:37:38.152394798Z 41 PC: 9504c | Parse filename
2018-12-25T12:37:38.154670891Z 26 PC: 984f7 | Set disk transfer address
2018-12-25T12:37:38.156667401Z 71 PC: 986f3 | Get current directory
2018-12-25T12:37:38.158836987Z 78 PC: 986fe | Find first file
2018-12-25T12:37:38.164904611Z 71 PC: 986f3 | Get current directory (See above)
2018-12-25T12:37:38.167224519Z 78 PC: 986fe | Find first file (See above)
2018-12-25T12:37:38.17354699Z 64 PC: 9a848 | Write file or device (Write 26 bytes on handle 2)
2018-12-25T12:37:38.176718037Z 37 PC: 123c4 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T12:37:38.178361326Z 37 PC: 123cb | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T12:37:38.17968069Z 37 PC: 123d2 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:37:38.180842675Z 62 PC: 122ab | Close file
2018-12-25T12:37:38.18380303Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.185222248Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.186593311Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.188873192Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.190201069Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.191526855Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.193168237Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.194536986Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.19603198Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.197828696Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.199108209Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.200410519Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.202167405Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.203541147Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:37:38.205230736Z 99 PC: 9a5d7 | Get DBCS lead byte table pointer
2018-12-25T12:37:38.207338169Z 56 PC: 94df9 | Get or set country info
2018-12-25T12:37:38.209108837Z 64 PC: 9a848 | Write file or device (See above)
2018-12-25T12:37:38.214495097Z 25 PC: 94e62 | Get default drive
2018-12-25T12:37:38.216431959Z 71 PC: 970dd | Get current directory
2018-12-25T12:37:38.220193803Z 64 PC: 9a848 | Write file or device (See above)
2018-12-25T12:37:38.22317861Z 2 PC: 970b2 | Character output (Char = '3e')
2018-12-25T12:37:38.225652491Z 93 PC: 94f20 | File sharing functions
2018-12-25T12:37:38.227166895Z 93 PC: 94f27 | File sharing functions
2018-12-25T12:37:38.228731976Z 10 PC: 94f39 | Buffered keyboard input
2018-12-25T12:37:53.18818289Z 0 PC: 0 | Program terminate (See above)
2018-12-25T12:37:54.542623569Z 0 PC: 0 | Program terminate (See above)
2018-12-25T12:37:54.645691645Z 64 PC: 9a848 | Write file or device (See above)
2018-12-25T12:37:54.651564377Z 41 PC: 94fae | Parse filename (See above)
2018-12-25T12:37:54.653627794Z 41 PC: 9502f | Parse filename (See above)
2018-12-25T12:37:54.656053913Z 41 PC: 9504c | Parse filename (See above)
2018-12-25T12:37:54.659706649Z 26 PC: 984f7 | Set disk transfer address (See above)
2018-12-25T12:37:54.661620693Z 71 PC: 986f3 | Get current directory (See above)
2018-12-25T12:37:54.67080914Z 78 PC: 986fe | Find first file (See above)
2018-12-25T12:37:54.680668168Z 71 PC: 9856c | Get current directory
2018-12-25T12:37:54.683897409Z 73 PC: 97c09 | Release memory
2018-12-25T12:37:54.686304252Z 75 PC: 11821 | Execute program
2018-12-25T12:37:54.700470889Z 9 PC: 12a47 | Display string (String= 'Hello, World! ')
2018-12-25T12:37:54.704665478Z 76 PC: 12a4b | Terminate with return code (Return code = '36')