Sample viewer

vx.netlux.org/Virus.DOS.DM.674

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:01:41.680049456Z 25 PC: 12aa0 | Get default drive
2018-12-17T23:01:41.681544021Z 71 PC: 12ab6 | Get current directory
2018-12-17T23:01:41.699943024Z 26 PC: 12ac2 | Set disk transfer address
2018-12-17T23:01:41.700893283Z 78 PC: 12ae2 | Find first file
2018-12-17T23:01:41.70770922Z 61 PC: 12af1 | Open file (Filename = 'SLEEP.COM')
2018-12-17T23:01:41.71401368Z 63 PC: 12b08 | Read file or device (Read 8 bytes on handle 5)
2018-12-17T23:01:41.719999939Z 66 PC: 12bde | Move file pointer
2018-12-17T23:01:41.721851417Z 64 PC: 12be6 | Write file or device (Write 8 bytes on handle 5)
2018-12-17T23:01:41.724338433Z 66 PC: 12bf0 | Move file pointer
2018-12-17T23:01:41.725562392Z 64 PC: 12bfd | Write file or device (Write 674 bytes on handle 5)
2018-12-17T23:01:41.820659125Z 62 PC: 12c01 | Close file
2018-12-17T23:01:41.82842515Z 42 PC: 12c05 | Get date 0x12c05: mov al, dl
0x12c07: mov ah, 0
0x12c09: mov bl, 0xa
0x12c0b: div bl
0x12c0d: cmp ah, 0
0x12c10: jne 0x12bac
0x12c12: mov dx, 0x80
0x12c15: mov cx, 1
0x12c18: mov ax, 0x380
0x12c1b: xor bx, bx
0x12c1d: mov es, bx
0x12c1f: int 0x13
0x12c21: jmp 0x12bac
0x12c23: call 0x12c61
0x12c29: mov ah, 0x4c
0x12c2b: nop
0x12c2c: nop
0x12c2d: mov bx, 0x297
0x12c30: jmp bx
0x12c32: add byte ptr [si + 0x4d], al
2018-12-17T23:01:41.830604749Z 26 PC: 12b90 | Set disk transfer address
2018-12-17T23:01:41.832685943Z 14 PC: 12b99 | Set default drive (Drive = 'A')
2018-12-17T23:01:41.833983283Z 59 PC: 12ba5 | Change current directory
2018-12-17T23:01:41.837851628Z 76 PC: 12a4e | Terminate with return code (Return code = '0')