Sample viewer

vx.netlux.org/Virus.DOS.ParityError.621

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:01:15.74679791Z 42 PC: 12a6b | Get date 0x12a6b: cmp dl, 1
0x12a6e: jne 0x12a73
0x12a70: jmp 0x12c16
0x12a73: cmp cx, 0x7d0
0x12a77: jne 0x12a7c
0x12a79: jmp 0x12c4e
0x12a7c: cmp dl, 0xd
0x12a7f: jne 0x12a88
0x12a81: cmp al, 5
0x12a83: jne 0x12a88
0x12a85: jmp 0x12c89
0x12a88: call 0x12a8e
0x12a8b: jmp 0x12acd
0x12a8d: nop
0x12a8e: pop si
0x12a8f: push si
0x12a90: ret
0x12a91: add ax, 0x3f3f
0x12a94: aas
0x12a95: aas
2018-12-17T23:01:15.749515383Z 26 PC: 12ad6 | Set disk transfer address
2018-12-17T23:01:15.75060287Z 78 PC: 12adf | Find first file
2018-12-17T23:01:15.756682197Z 67 PC: 12b06 | Get or set file attributes
2018-12-17T23:01:15.772902319Z 61 PC: 12b0b | Open file (Filename = 'SLEEP.COM')
2018-12-17T23:01:15.779299101Z 87 PC: 12b1a | Get or set file date and time
2018-12-17T23:01:15.780548863Z 63 PC: 12b2b | Read file or device (Read 3 bytes on handle 5)
2018-12-17T23:01:15.787184972Z 66 PC: 12b3e | Move file pointer
2018-12-17T23:01:15.788500812Z 66 PC: 12b4f | Move file pointer
2018-12-17T23:01:15.78975869Z 66 PC: 12b6a | Move file pointer
2018-12-17T23:01:15.791507519Z 64 PC: 12b81 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T23:01:15.79405757Z 66 PC: 12b8c | Move file pointer
2018-12-17T23:01:15.795445301Z 64 PC: 12bbe | Write file or device (Write 621 bytes on handle 5)
2018-12-17T23:01:15.804520556Z 87 PC: 12bc5 | Get or set file date and time
2018-12-17T23:01:15.805902656Z 62 PC: 12bc9 | Close file
2018-12-17T23:01:15.813268413Z 9 PC: 12a47 | Display string (String= 'Jihuu! Ohjelma toimii!!! ')
2018-12-17T23:01:15.817493971Z 76 PC: 12a4c | Terminate with return code (Return code = '0')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13808,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:02.966952856Z 42 PC: 12a6b | Get date 0x12a6b: cmp dl, 1
0x12a6e: jne 0x12a73
0x12a70: jmp 0x12c16
0x12a73: cmp cx, 0x7d0
0x12a77: jne 0x12a7c
0x12a79: jmp 0x12c4e
0x12a7c: cmp dl, 0xd
0x12a7f: jne 0x12a88
0x12a81: cmp al, 5
0x12a83: jne 0x12a88
0x12a85: jmp 0x12c89
0x12a88: call 0x12a8e
0x12a8b: jmp 0x12acd
0x12a8d: nop
0x12a8e: pop si
0x12a8f: push si
0x12a90: ret
0x12a91: add ax, 0x3f3f
0x12a94: aas
0x12a95: aas
2018-12-25T12:39:02.969451577Z 9 PC: 12c49 | Display string (String= 'Water detected in math-co-processor ')
2018-12-25T12:39:02.976630143Z 76 PC: 12c4e | Terminate with return code (Return code = '1')

{"DateBased":true,"Day":2,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13808,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:04.059778133Z 42 PC: 12a6b | Get date 0x12a6b: cmp dl, 1
0x12a6e: jne 0x12a73
0x12a70: jmp 0x12c16
0x12a73: cmp cx, 0x7d0
0x12a77: jne 0x12a7c
0x12a79: jmp 0x12c4e
0x12a7c: cmp dl, 0xd
0x12a7f: jne 0x12a88
0x12a81: cmp al, 5
0x12a83: jne 0x12a88
0x12a85: jmp 0x12c89
0x12a88: call 0x12a8e
0x12a8b: jmp 0x12acd
0x12a8d: nop
0x12a8e: pop si
0x12a8f: push si
0x12a90: ret
0x12a91: add ax, 0x3f3f
0x12a94: aas
0x12a95: aas
2018-12-25T12:39:04.06195373Z 26 PC: 12ad6 | Set disk transfer address
2018-12-25T12:39:04.062963635Z 78 PC: 12adf | Find first file
2018-12-25T12:39:04.068496398Z 67 PC: 12b06 | Get or set file attributes
2018-12-25T12:39:04.081774055Z 61 PC: 12b0b | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:39:04.088798452Z 87 PC: 12b1a | Get or set file date and time
2018-12-25T12:39:04.089783659Z 63 PC: 12b2b | Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:39:04.094464271Z 66 PC: 12b3e | Move file pointer
2018-12-25T12:39:04.096073935Z 66 PC: 12b4f | Move file pointer
2018-12-25T12:39:04.097354469Z 66 PC: 12b6a | Move file pointer
2018-12-25T12:39:04.098627654Z 64 PC: 12b81 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:39:04.101327227Z 66 PC: 12b8c | Move file pointer
2018-12-25T12:39:04.102622625Z 64 PC: 12bbe | Write file or device (Write 621 bytes on handle 5)
2018-12-25T12:39:04.111042214Z 87 PC: 12bc5 | Get or set file date and time
2018-12-25T12:39:04.115331847Z 62 PC: 12bc9 | Close file
2018-12-25T12:39:04.12301077Z 9 PC: 12a47 | Display string (String= 'Jihuu! Ohjelma toimii!!! ')
2018-12-25T12:39:04.12819591Z 76 PC: 12a4c | Terminate with return code (Return code = '0')

{"DateBased":true,"Day":13,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13808,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:04.461127356Z 42 PC: 12a6b | Get date 0x12a6b: cmp dl, 1
0x12a6e: jne 0x12a73
0x12a70: jmp 0x12c16
0x12a73: cmp cx, 0x7d0
0x12a77: jne 0x12a7c
0x12a79: jmp 0x12c4e
0x12a7c: cmp dl, 0xd
0x12a7f: jne 0x12a88
0x12a81: cmp al, 5
0x12a83: jne 0x12a88
0x12a85: jmp 0x12c89
0x12a88: call 0x12a8e
0x12a8b: jmp 0x12acd
0x12a8d: nop
0x12a8e: pop si
0x12a8f: push si
0x12a90: ret
0x12a91: add ax, 0x3f3f
0x12a94: aas
0x12a95: aas
2018-12-25T12:39:04.464054595Z 26 PC: 12ad6 | Set disk transfer address
2018-12-25T12:39:04.465978661Z 78 PC: 12adf | Find first file
2018-12-25T12:39:04.472380636Z 67 PC: 12b06 | Get or set file attributes
2018-12-25T12:39:04.493799249Z 61 PC: 12b0b | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:39:04.500793918Z 87 PC: 12b1a | Get or set file date and time
2018-12-25T12:39:04.502415646Z 63 PC: 12b2b | Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:39:04.516841462Z 66 PC: 12b3e | Move file pointer
2018-12-25T12:39:04.518516073Z 66 PC: 12b4f | Move file pointer
2018-12-25T12:39:04.520575294Z 66 PC: 12b6a | Move file pointer
2018-12-25T12:39:04.521907301Z 64 PC: 12b81 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:39:04.534563455Z 66 PC: 12b8c | Move file pointer
2018-12-25T12:39:04.535810155Z 64 PC: 12bbe | Write file or device (Write 621 bytes on handle 5)
2018-12-25T12:39:04.543868197Z 87 PC: 12bc5 | Get or set file date and time
2018-12-25T12:39:04.546229459Z 62 PC: 12bc9 | Close file
2018-12-25T12:39:04.553786615Z 9 PC: 12a47 | Display string (String= 'Jihuu! Ohjelma toimii!!! ')
2018-12-25T12:39:04.557846808Z 76 PC: 12a4c | Terminate with return code (Return code = '0')

{"DateBased":true,"Day":13,"Month":6,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13808,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:06.899759666Z 42 PC: 12a6b | Get date 0x12a6b: cmp dl, 1
0x12a6e: jne 0x12a73
0x12a70: jmp 0x12c16
0x12a73: cmp cx, 0x7d0
0x12a77: jne 0x12a7c
0x12a79: jmp 0x12c4e
0x12a7c: cmp dl, 0xd
0x12a7f: jne 0x12a88
0x12a81: cmp al, 5
0x12a83: jne 0x12a88
0x12a85: jmp 0x12c89
0x12a88: call 0x12a8e
0x12a8b: jmp 0x12acd
0x12a8d: nop
0x12a8e: pop si
0x12a8f: push si
0x12a90: ret
0x12a91: add ax, 0x3f3f
0x12a94: aas
0x12a95: aas
2018-12-25T12:39:06.903431582Z 9 PC: 12cce | Display string (String= 'Something wonderful has happened, your PC is alive... ')
2018-12-25T12:39:06.908790792Z 26 PC: 12ad6 | Set disk transfer address
2018-12-25T12:39:06.909766478Z 78 PC: 12adf | Find first file
2018-12-25T12:39:06.915550242Z 67 PC: 12b06 | Get or set file attributes
2018-12-25T12:39:06.934587383Z 61 PC: 12b0b | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:39:06.946184939Z 87 PC: 12b1a | Get or set file date and time
2018-12-25T12:39:06.947633666Z 63 PC: 12b2b | Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:39:06.954547672Z 66 PC: 12b3e | Move file pointer
2018-12-25T12:39:06.955797793Z 66 PC: 12b4f | Move file pointer
2018-12-25T12:39:06.957058184Z 66 PC: 12b6a | Move file pointer
2018-12-25T12:39:06.958935249Z 64 PC: 12b81 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:39:06.961551057Z 66 PC: 12b8c | Move file pointer
2018-12-25T12:39:06.963024558Z 64 PC: 12bbe | Write file or device (Write 621 bytes on handle 5)
2018-12-25T12:39:06.975139431Z 87 PC: 12bc5 | Get or set file date and time
2018-12-25T12:39:06.976681087Z 62 PC: 12bc9 | Close file
2018-12-25T12:39:06.984087117Z 9 PC: 12a47 | Display string (String= 'Jihuu! Ohjelma toimii!!! ')
2018-12-25T12:39:06.988209723Z 76 PC: 12a4c | Terminate with return code (Return code = '0')

{"DateBased":true,"Day":2,"Month":1,"Year":2000,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13808,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:08.078324928Z 42 PC: 12a6b | Get date 0x12a6b: cmp dl, 1
0x12a6e: jne 0x12a73
0x12a70: jmp 0x12c16
0x12a73: cmp cx, 0x7d0
0x12a77: jne 0x12a7c
0x12a79: jmp 0x12c4e
0x12a7c: cmp dl, 0xd
0x12a7f: jne 0x12a88
0x12a81: cmp al, 5
0x12a83: jne 0x12a88
0x12a85: jmp 0x12c89
0x12a88: call 0x12a8e
0x12a8b: jmp 0x12acd
0x12a8d: nop
0x12a8e: pop si
0x12a8f: push si
0x12a90: ret
0x12a91: add ax, 0x3f3f
0x12a94: aas
0x12a95: aas
2018-12-25T12:39:08.081415166Z 9 PC: 12c79 | Display string (String= 'PARITY ERROR System halted ')