Sample viewer

vx.netlux.org/Virus.DOS.Cascade.1701.m

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-17T23:01:26.534830972Z	48	PC: 12ae0 \| Get DOS version
2018-12-17T23:01:26.536423594Z	75	PC: 12aee \| Execute program
2018-12-17T23:01:26.538612702Z	53	PC: 12b09 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:01:26.540552166Z	80	PC: 12b70 \| Set current PSP
2018-12-17T23:01:26.542932477Z	37	PC: 12bdc \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:01:26.544796787Z	26	PC: 12be4 \| Set disk transfer address
2018-12-17T23:01:26.546646444Z	42	PC: 12beb \| Get date 0x12beb: cmp cx, 0x7c4 0x12bef: ja 0x12c56 0x12bf1: je 0x12c1d 0x12bf3: cmp cx, 0x7bc 0x12bf7: jne 0x12c56 0x12bf9: push ds 0x12bfa: mov ax, 0x3528 0x12bfd: int 0x21 0x12bff: mov word ptr cs:[0x13b], bx 0x12c04: mov word ptr cs:[0x13d], es 0x12c09: mov ax, 0x2528 0x12c0c: mov dx, 0x722 0x12c0f: push cs 0x12c10: pop ds 0x12c11: int 0x21 0x12c13: pop ds 0x12c14: or byte ptr cs:[0x157], 8 0x12c1a: jmp 0x12c22 0x12c1c: nop 0x12c1d: cmp dh, 0xa

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13874,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:15.245041915Z	48	PC: 12ae0 \| Get DOS version
2018-12-25T12:39:15.247628643Z	75	PC: 12aee \| Execute program
2018-12-25T12:39:15.249629824Z	53	PC: 12b09 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:15.251195917Z	80	PC: 12b70 \| Set current PSP
2018-12-25T12:39:15.253663567Z	37	PC: 12bdc \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:15.254892518Z	26	PC: 12be4 \| Set disk transfer address
2018-12-25T12:39:15.256046701Z	42	PC: 12beb \| Get date 0x12beb: cmp cx, 0x7c4 0x12bef: ja 0x12c56 0x12bf1: je 0x12c1d 0x12bf3: cmp cx, 0x7bc 0x12bf7: jne 0x12c56 0x12bf9: push ds 0x12bfa: mov ax, 0x3528 0x12bfd: int 0x21 0x12bff: mov word ptr cs:[0x13b], bx 0x12c04: mov word ptr cs:[0x13d], es 0x12c09: mov ax, 0x2528 0x12c0c: mov dx, 0x722 0x12c0f: push cs 0x12c10: pop ds 0x12c11: int 0x21 0x12c13: pop ds 0x12c14: or byte ptr cs:[0x157], 8 0x12c1a: jmp 0x12c22 0x12c1c: nop 0x12c1d: cmp dh, 0xa
2018-12-25T12:39:15.258270064Z	53	PC: 12bff \| Get interrupt vector (Interrupt = '40' AKA 'Random block write')
2018-12-25T12:39:15.260676148Z	37	PC: 12c13 \| Set interrupt vector (Interrupt = '40' AKA 'Random block write')
2018-12-25T12:39:15.322343088Z	53	PC: 12c40 \| Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:15.323606496Z	37	PC: 12c55 \| Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')

{"DateBased":true,"Day":1,"Month":1,"Year":1981,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13874,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:15.280642535Z	48	PC: 12ae0 \| Get DOS version
2018-12-25T12:39:15.282124059Z	75	PC: 12aee \| Execute program
2018-12-25T12:39:15.283385031Z	53	PC: 12b09 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:15.285113061Z	80	PC: 12b70 \| Set current PSP
2018-12-25T12:39:15.286723411Z	37	PC: 12bdc \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:15.287814189Z	26	PC: 12be4 \| Set disk transfer address
2018-12-25T12:39:15.288807032Z	42	PC: 12beb \| Get date 0x12beb: cmp cx, 0x7c4 0x12bef: ja 0x12c56 0x12bf1: je 0x12c1d 0x12bf3: cmp cx, 0x7bc 0x12bf7: jne 0x12c56 0x12bf9: push ds 0x12bfa: mov ax, 0x3528 0x12bfd: int 0x21 0x12bff: mov word ptr cs:[0x13b], bx 0x12c04: mov word ptr cs:[0x13d], es 0x12c09: mov ax, 0x2528 0x12c0c: mov dx, 0x722 0x12c0f: push cs 0x12c10: pop ds 0x12c11: int 0x21 0x12c13: pop ds 0x12c14: or byte ptr cs:[0x157], 8 0x12c1a: jmp 0x12c22 0x12c1c: nop 0x12c1d: cmp dh, 0xa

{"DateBased":true,"Day":1,"Month":1,"Year":1988,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13874,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:15.365025415Z	48	PC: 12ae0 \| Get DOS version
2018-12-25T12:39:15.368076441Z	75	PC: 12aee \| Execute program
2018-12-25T12:39:15.370180729Z	53	PC: 12b09 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:15.37204617Z	80	PC: 12b70 \| Set current PSP
2018-12-25T12:39:15.375008684Z	37	PC: 12bdc \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:15.376823195Z	26	PC: 12be4 \| Set disk transfer address
2018-12-25T12:39:15.378556955Z	42	PC: 12beb \| Get date 0x12beb: cmp cx, 0x7c4 0x12bef: ja 0x12c56 0x12bf1: je 0x12c1d 0x12bf3: cmp cx, 0x7bc 0x12bf7: jne 0x12c56 0x12bf9: push ds 0x12bfa: mov ax, 0x3528 0x12bfd: int 0x21 0x12bff: mov word ptr cs:[0x13b], bx 0x12c04: mov word ptr cs:[0x13d], es 0x12c09: mov ax, 0x2528 0x12c0c: mov dx, 0x722 0x12c0f: push cs 0x12c10: pop ds 0x12c11: int 0x21 0x12c13: pop ds 0x12c14: or byte ptr cs:[0x157], 8 0x12c1a: jmp 0x12c22 0x12c1c: nop 0x12c1d: cmp dh, 0xa

{"DateBased":true,"Day":1,"Month":10,"Year":1988,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13874,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:15.464294584Z	48	PC: 12ae0 \| Get DOS version
2018-12-25T12:39:15.470497667Z	75	PC: 12aee \| Execute program
2018-12-25T12:39:15.471821754Z	53	PC: 12b09 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:15.47294847Z	80	PC: 12b70 \| Set current PSP
2018-12-25T12:39:15.474858843Z	37	PC: 12bdc \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:15.476419322Z	26	PC: 12be4 \| Set disk transfer address
2018-12-25T12:39:15.478133902Z	42	PC: 12beb \| Get date 0x12beb: cmp cx, 0x7c4 0x12bef: ja 0x12c56 0x12bf1: je 0x12c1d 0x12bf3: cmp cx, 0x7bc 0x12bf7: jne 0x12c56 0x12bf9: push ds 0x12bfa: mov ax, 0x3528 0x12bfd: int 0x21 0x12bff: mov word ptr cs:[0x13b], bx 0x12c04: mov word ptr cs:[0x13d], es 0x12c09: mov ax, 0x2528 0x12c0c: mov dx, 0x722 0x12c0f: push cs 0x12c10: pop ds 0x12c11: int 0x21 0x12c13: pop ds 0x12c14: or byte ptr cs:[0x157], 8 0x12c1a: jmp 0x12c22 0x12c1c: nop 0x12c1d: cmp dh, 0xa
2018-12-25T12:39:15.546773029Z	53	PC: 12c40 \| Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:15.548016302Z	37	PC: 12c55 \| Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')

{"DateBased":true,"Day":1,"Month":1,"Year":1989,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13874,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:16.017066006Z	48	PC: 12ae0 \| Get DOS version
2018-12-25T12:39:16.018738444Z	75	PC: 12aee \| Execute program
2018-12-25T12:39:16.020473403Z	53	PC: 12b09 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:16.021938815Z	80	PC: 12b70 \| Set current PSP
2018-12-25T12:39:16.024371042Z	37	PC: 12bdc \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:16.025659672Z	26	PC: 12be4 \| Set disk transfer address
2018-12-25T12:39:16.027067652Z	42	PC: 12beb \| Get date 0x12beb: cmp cx, 0x7c4 0x12bef: ja 0x12c56 0x12bf1: je 0x12c1d 0x12bf3: cmp cx, 0x7bc 0x12bf7: jne 0x12c56 0x12bf9: push ds 0x12bfa: mov ax, 0x3528 0x12bfd: int 0x21 0x12bff: mov word ptr cs:[0x13b], bx 0x12c04: mov word ptr cs:[0x13d], es 0x12c09: mov ax, 0x2528 0x12c0c: mov dx, 0x722 0x12c0f: push cs 0x12c10: pop ds 0x12c11: int 0x21 0x12c13: pop ds 0x12c14: or byte ptr cs:[0x157], 8 0x12c1a: jmp 0x12c22 0x12c1c: nop 0x12c1d: cmp dh, 0xa

{"DateBased":true,"Day":1,"Month":1,"Year":1989,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13874,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:16.085910085Z	48	PC: 12ae0 \| Get DOS version
2018-12-25T12:39:16.087990458Z	75	PC: 12aee \| Execute program
2018-12-25T12:39:16.089636944Z	53	PC: 12b09 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:16.091151775Z	80	PC: 12b70 \| Set current PSP
2018-12-25T12:39:16.093392671Z	37	PC: 12bdc \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:16.094940581Z	26	PC: 12be4 \| Set disk transfer address
2018-12-25T12:39:16.096293905Z	42	PC: 12beb \| Get date 0x12beb: cmp cx, 0x7c4 0x12bef: ja 0x12c56 0x12bf1: je 0x12c1d 0x12bf3: cmp cx, 0x7bc 0x12bf7: jne 0x12c56 0x12bf9: push ds 0x12bfa: mov ax, 0x3528 0x12bfd: int 0x21 0x12bff: mov word ptr cs:[0x13b], bx 0x12c04: mov word ptr cs:[0x13d], es 0x12c09: mov ax, 0x2528 0x12c0c: mov dx, 0x722 0x12c0f: push cs 0x12c10: pop ds 0x12c11: int 0x21 0x12c13: pop ds 0x12c14: or byte ptr cs:[0x157], 8 0x12c1a: jmp 0x12c22 0x12c1c: nop 0x12c1d: cmp dh, 0xa

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13874,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:16.426222365Z	48	PC: 12ae0 \| Get DOS version
2018-12-25T12:39:16.428169942Z	75	PC: 12aee \| Execute program
2018-12-25T12:39:16.430014012Z	53	PC: 12b09 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:16.43155898Z	80	PC: 12b70 \| Set current PSP
2018-12-25T12:39:16.433398262Z	37	PC: 12bdc \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:16.435168695Z	26	PC: 12be4 \| Set disk transfer address
2018-12-25T12:39:16.437423251Z	42	PC: 12beb \| Get date 0x12beb: cmp cx, 0x7c4 0x12bef: ja 0x12c56 0x12bf1: je 0x12c1d 0x12bf3: cmp cx, 0x7bc 0x12bf7: jne 0x12c56 0x12bf9: push ds 0x12bfa: mov ax, 0x3528 0x12bfd: int 0x21 0x12bff: mov word ptr cs:[0x13b], bx 0x12c04: mov word ptr cs:[0x13d], es 0x12c09: mov ax, 0x2528 0x12c0c: mov dx, 0x722 0x12c0f: push cs 0x12c10: pop ds 0x12c11: int 0x21 0x12c13: pop ds 0x12c14: or byte ptr cs:[0x157], 8 0x12c1a: jmp 0x12c22 0x12c1c: nop 0x12c1d: cmp dh, 0xa
2018-12-25T12:39:16.441082104Z	53	PC: 12bff \| Get interrupt vector (Interrupt = '40' AKA 'Random block write')
2018-12-25T12:39:16.443312572Z	37	PC: 12c13 \| Set interrupt vector (Interrupt = '40' AKA 'Random block write')
2018-12-25T12:39:16.485638389Z	53	PC: 12c40 \| Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:16.487162505Z	37	PC: 12c55 \| Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')

{"DateBased":true,"Day":1,"Month":1,"Year":1981,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13874,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:16.65272724Z	48	PC: 12ae0 \| Get DOS version
2018-12-25T12:39:16.654542922Z	75	PC: 12aee \| Execute program
2018-12-25T12:39:16.656285758Z	53	PC: 12b09 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:16.657800383Z	80	PC: 12b70 \| Set current PSP
2018-12-25T12:39:16.66128861Z	37	PC: 12bdc \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:16.662704449Z	26	PC: 12be4 \| Set disk transfer address
2018-12-25T12:39:16.664149294Z	42	PC: 12beb \| Get date 0x12beb: cmp cx, 0x7c4 0x12bef: ja 0x12c56 0x12bf1: je 0x12c1d 0x12bf3: cmp cx, 0x7bc 0x12bf7: jne 0x12c56 0x12bf9: push ds 0x12bfa: mov ax, 0x3528 0x12bfd: int 0x21 0x12bff: mov word ptr cs:[0x13b], bx 0x12c04: mov word ptr cs:[0x13d], es 0x12c09: mov ax, 0x2528 0x12c0c: mov dx, 0x722 0x12c0f: push cs 0x12c10: pop ds 0x12c11: int 0x21 0x12c13: pop ds 0x12c14: or byte ptr cs:[0x157], 8 0x12c1a: jmp 0x12c22 0x12c1c: nop 0x12c1d: cmp dh, 0xa

{"DateBased":true,"Day":1,"Month":1,"Year":1988,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13874,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:16.808119709Z	48	PC: 12ae0 \| Get DOS version
2018-12-25T12:39:16.810258089Z	75	PC: 12aee \| Execute program
2018-12-25T12:39:16.81205533Z	53	PC: 12b09 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:16.81362166Z	80	PC: 12b70 \| Set current PSP
2018-12-25T12:39:16.815937988Z	37	PC: 12bdc \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:16.817432954Z	26	PC: 12be4 \| Set disk transfer address
2018-12-25T12:39:16.818924159Z	42	PC: 12beb \| Get date 0x12beb: cmp cx, 0x7c4 0x12bef: ja 0x12c56 0x12bf1: je 0x12c1d 0x12bf3: cmp cx, 0x7bc 0x12bf7: jne 0x12c56 0x12bf9: push ds 0x12bfa: mov ax, 0x3528 0x12bfd: int 0x21 0x12bff: mov word ptr cs:[0x13b], bx 0x12c04: mov word ptr cs:[0x13d], es 0x12c09: mov ax, 0x2528 0x12c0c: mov dx, 0x722 0x12c0f: push cs 0x12c10: pop ds 0x12c11: int 0x21 0x12c13: pop ds 0x12c14: or byte ptr cs:[0x157], 8 0x12c1a: jmp 0x12c22 0x12c1c: nop 0x12c1d: cmp dh, 0xa

{"DateBased":true,"Day":1,"Month":10,"Year":1988,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13874,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:16.809367111Z	48	PC: 12ae0 \| Get DOS version
2018-12-25T12:39:16.811085672Z	75	PC: 12aee \| Execute program
2018-12-25T12:39:16.812716562Z	53	PC: 12b09 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:16.814142227Z	80	PC: 12b70 \| Set current PSP
2018-12-25T12:39:16.816550539Z	37	PC: 12bdc \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:16.828465748Z	26	PC: 12be4 \| Set disk transfer address
2018-12-25T12:39:16.830660912Z	42	PC: 12beb \| Get date 0x12beb: cmp cx, 0x7c4 0x12bef: ja 0x12c56 0x12bf1: je 0x12c1d 0x12bf3: cmp cx, 0x7bc 0x12bf7: jne 0x12c56 0x12bf9: push ds 0x12bfa: mov ax, 0x3528 0x12bfd: int 0x21 0x12bff: mov word ptr cs:[0x13b], bx 0x12c04: mov word ptr cs:[0x13d], es 0x12c09: mov ax, 0x2528 0x12c0c: mov dx, 0x722 0x12c0f: push cs 0x12c10: pop ds 0x12c11: int 0x21 0x12c13: pop ds 0x12c14: or byte ptr cs:[0x157], 8 0x12c1a: jmp 0x12c22 0x12c1c: nop 0x12c1d: cmp dh, 0xa
2018-12-25T12:39:16.891792324Z	53	PC: 12c40 \| Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:16.893650294Z	37	PC: 12c55 \| Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')