Sample viewer

vx.netlux.org/Virus.DOS.Beer.3229

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:59:52.197769112Z 48 PC: 131cf | Get DOS version
2018-12-17T22:59:52.200022388Z 53 PC: 1324d | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:59:52.201632561Z 37 PC: 13284 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:59:52.203054078Z 48 PC: 13303 | Get DOS version
2018-12-17T22:59:52.204770034Z 53 PC: 1330d | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:59:52.212140013Z 37 PC: 13322 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:59:52.21418014Z 47 PC: 13328 | Get disk transfer address
2018-12-17T22:59:52.21634297Z 26 PC: 13338 | Set disk transfer address
2018-12-17T22:59:52.23277031Z 78 PC: 13342 | Find first file
2018-12-17T22:59:52.239021369Z 53 PC: 9ef4c | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:59:52.240516057Z 37 PC: 9ef4c | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:59:52.24222705Z 67 PC: 9ef4c | Get or set file attributes
2018-12-17T22:59:52.248155133Z 67 PC: 9ef4c | Get or set file attributes
2018-12-17T22:59:52.265010493Z 61 PC: 9ef4c | Open file (Filename = 'FILENAME.EXT')
2018-12-17T22:59:52.273411325Z 87 PC: 9ef4c | Get or set file date and time
2018-12-17T22:59:52.274958867Z 66 PC: 9ef4c | Move file pointer
2018-12-17T22:59:52.27649192Z 66 PC: 9ef4c | Move file pointer
2018-12-17T22:59:52.290241596Z 63 PC: 9ef4c | Read file or device (Read 28 bytes on handle 5)
2018-12-17T22:59:52.294015943Z 62 PC: 9ef4c | Close file
2018-12-17T22:59:52.296494608Z 42 PC: 9ef4c | Get date 0x9ef4c: ret
0x9ef4d: push ds
0x9ef4e: pop es
0x9ef4f: push ds
0x9ef50: pop word ptr cs:[0xdf8]
0x9ef55: mov word ptr cs:[0xdf6], dx
0x9ef5a: mov ax, 0x4300
0x9ef5d: call 0xaef46
0x9ef60: jb 0x9ef37
0x9ef62: test cx, 0x1e
0x9ef66: jne 0x9ef37
0x9ef68: mov word ptr cs:[0xdfc], cx
0x9ef6d: and cx, 0xfe
0x9ef71: mov dx, word ptr cs:[0xdf6]
0x9ef76: mov ax, 0x4301
0x9ef79: call 0xaef46
0x9ef7c: jb 0x9ef37
0x9ef7e: mov dx, word ptr cs:[0xdf6]
0x9ef83: mov di, dx
0x9ef85: xor al, al
2018-12-17T22:59:52.301341488Z 37 PC: 9ef4c | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:59:52.303391569Z 61 PC: 1334c | Open file (Filename = '')
2018-12-17T22:59:52.316186537Z 62 PC: 13354 | Close file
2018-12-17T22:59:52.318853633Z 79 PC: 13360 | Find next file
2018-12-17T22:59:52.322128282Z 37 PC: 13372 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:59:52.324069061Z 26 PC: 1337b | Set disk transfer address
2018-12-17T22:59:52.326521482Z 9 PC: 138b5 | Display string (String= '�� 業�p � � ᠬ�室���� �p��p����o�� ���ᯥ祭�� � � ����� �笥����� ����� � ����������������������������������������� ')
2018-12-17T22:59:52.330833943Z 76 PC: 138ba | Terminate with return code (Return code = '0')