Sample viewer

vx.netlux.org/Virus.DOS.Lucky.1083

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-17T23:02:09.037803256Z	255	PC: 12a4a \| UNKNOWN!
2018-12-17T23:02:09.03930456Z	38	PC: 12a71 \| Create PSP
2018-12-17T23:02:09.040739917Z	37	PC: 12a87 \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:02:09.042201379Z	42	PC: 12a8b \| Get date 0x12a8b: cmp dl, 0x13 0x12a8e: jne 0x12a9b 0x12a90: cmp dh, 1 0x12a93: jne 0x12a98 0x12a95: call 0x12e3c 0x12a98: call 0x12da8 0x12a9b: mov ax, cs 0x12a9d: mov ds, ax 0x12a9f: mov es, ax 0x12aa1: mov si, word ptr [0x103] 0x12aa5: mov di, 0x100 0x12aa8: mov cx, 0x43b 0x12aab: cld 0x12aac: rep movsb byte ptr es:[di], byte ptr [si] 0x12aae: jmp 0x12a40 0x12ab0: inc word ptr [bx + si] 0x12ab2: add byte ptr [bx + si], al 0x12ab4: add byte ptr [bx + si], al 0x12ab6: push ss 0x12ab7: add ax, word ptr [bx + 0x4f]

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":14116,"SideJobID":0}

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:46.694429779Z	255	PC: 12a4a \| UNKNOWN!
2018-12-25T12:39:46.69676988Z	38	PC: 12a71 \| Create PSP
2018-12-25T12:39:46.698733293Z	37	PC: 12a87 \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:46.700240334Z	42	PC: 12a8b \| Get date 0x12a8b: cmp dl, 0x13 0x12a8e: jne 0x12a9b 0x12a90: cmp dh, 1 0x12a93: jne 0x12a98 0x12a95: call 0x12e3c 0x12a98: call 0x12da8 0x12a9b: mov ax, cs 0x12a9d: mov ds, ax 0x12a9f: mov es, ax 0x12aa1: mov si, word ptr [0x103] 0x12aa5: mov di, 0x100 0x12aa8: mov cx, 0x43b 0x12aab: cld 0x12aac: rep movsb byte ptr es:[di], byte ptr [si] 0x12aae: jmp 0x12a40 0x12ab0: inc word ptr [bx + si] 0x12ab2: add byte ptr [bx + si], al 0x12ab4: add byte ptr [bx + si], al 0x12ab6: push ss 0x12ab7: add ax, word ptr [bx + 0x4f]

{"DateBased":true,"Day":19,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":14116,"SideJobID":0}

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:46.884553005Z	255	PC: 12a4a \| UNKNOWN!
2018-12-25T12:39:46.88715376Z	38	PC: 12a71 \| Create PSP
2018-12-25T12:39:46.88891938Z	37	PC: 12a87 \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:46.890384565Z	42	PC: 12a8b \| Get date 0x12a8b: cmp dl, 0x13 0x12a8e: jne 0x12a9b 0x12a90: cmp dh, 1 0x12a93: jne 0x12a98 0x12a95: call 0x12e3c 0x12a98: call 0x12da8 0x12a9b: mov ax, cs 0x12a9d: mov ds, ax 0x12a9f: mov es, ax 0x12aa1: mov si, word ptr [0x103] 0x12aa5: mov di, 0x100 0x12aa8: mov cx, 0x43b 0x12aab: cld 0x12aac: rep movsb byte ptr es:[di], byte ptr [si] 0x12aae: jmp 0x12a40 0x12ab0: inc word ptr [bx + si] 0x12ab2: add byte ptr [bx + si], al 0x12ab4: add byte ptr [bx + si], al 0x12ab6: push ss 0x12ab7: add ax, word ptr [bx + 0x4f]
2018-12-25T12:39:49.015538145Z	72	PC: 8f1b9 \| Allocate memory
2018-12-25T12:39:49.018255555Z	72	PC: 8f1bd \| Allocate memory
2018-12-25T12:39:49.021335026Z	99	PC: 90858 \| Get DBCS lead byte table pointer
2018-12-25T12:39:49.025293568Z	61	PC: 91f88 \| Open file (Filename = 'C:\WINDOWS\HIMEM.SYS')
2018-12-25T12:39:49.038885889Z	66	PC: 91f95 \| Move file pointer
2018-12-25T12:39:49.04073801Z	62	PC: 91fc1 \| Close file
2018-12-25T12:39:49.043652781Z	75	PC: 91fe0 \| Execute program
2018-12-25T12:39:49.064955579Z	98	PC: 916f1 \| Get current PSP
2018-12-25T12:39:49.066485784Z	9	PC: c605 \| Display string (String= '6ï¿½ï¿½rï¿½&;]u')
2018-12-25T12:39:49.078488411Z	48	PC: c609 \| Get DOS version
2018-12-25T12:39:49.088650703Z	9	PC: c382 \| Display string (String= ' Installed A20 handler number ')
2018-12-25T12:39:49.094283694Z	2	PC: c38c \| Character output (Char = '32')
2018-12-25T12:39:49.097300878Z	2	PC: c3a7 \| Character output (Char = '2e')
2018-12-25T12:39:49.102168023Z	9	PC: c6d9 \| Display string (String= 'ï¿½ï¿½ï¿½ï¿½ï¿½VHï¿½VDï¿½ï¿½ï¿½V@ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½î°ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½_ï¿½ï¿½ï¿½Kuï¿½ï¿½t1ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Dï¿½ï¿½ï¿½ï¿½ï¿½t ï¿½ï¿½ ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½a1ï¿½ï¿½Zï¿½ï¿½ï¿½ï¿½ï¿½Wï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½5ï¿½ï¿½ï¿½\|ï¿½ï¿½ï¿½ï¿½ï¿½(ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ç‹ï¿½(ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½pï¿½^')
2018-12-25T12:39:49.108882236Z	9	PC: c6e0 \| Display string (String= 'ï¿½5ï¿½ï¿½ï¿½\|ï¿½ï¿½ï¿½ï¿½ï¿½(ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ç‹ï¿½(ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½pï¿½^')
2018-12-25T12:39:49.125411779Z	61	PC: 91f88 \| Open file (See above)
2018-12-25T12:39:49.138034078Z	66	PC: 91f95 \| Move file pointer (See above)
2018-12-25T12:39:49.140106643Z	62	PC: 91fc1 \| Close file (See above)
2018-12-25T12:39:49.142770772Z	75	PC: 91fe0 \| Execute program (See above)
2018-12-25T12:39:49.18307247Z	98	PC: 916f1 \| Get current PSP (See above)
2018-12-25T12:39:49.187556425Z	82	PC: 13d46 \| Get DOS internal pointers (SYSVARS)
2018-12-25T12:39:49.189105319Z	53	PC: 13ac3 \| Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T12:39:49.190685619Z	37	PC: 13ad6 \| Set interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T12:39:49.192987982Z	53	PC: 13ae0 \| Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T12:39:49.194326121Z	37	PC: 13af3 \| Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T12:39:49.195623401Z	9	PC: 13a0d \| Display string (Could not find end pointer)
2018-12-25T12:39:49.209638593Z	62	PC: 8f8eb \| Close file
2018-12-25T12:39:49.212222772Z	62	PC: 8f8f2 \| Close file
2018-12-25T12:39:49.214803932Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.217402065Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.219471133Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.221562759Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.224716897Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.226743207Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.228787236Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.231481413Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.233318513Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.235074804Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.237289179Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.239060659Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.241345037Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.243290133Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.245515546Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.247602934Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.249772927Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.252701597Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.254762651Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.261063949Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.265068989Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.266803514Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.268682638Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.271400775Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.273489379Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.275651757Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.280972516Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.283003531Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.28532316Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:39:49.287913091Z	61	PC: 8f8ff \| Open file (Filename = '')
2018-12-25T12:39:49.293296577Z	62	PC: 8f90e \| Close file
2018-12-25T12:39:49.295298547Z	69	PC: 8f915 \| Duplicate handle
2018-12-25T12:39:49.297534646Z	69	PC: 8f919 \| Duplicate handle
2018-12-25T12:39:49.299725291Z	61	PC: 9387b \| Open file (Filename = '')
2018-12-25T12:39:49.305686919Z	68	PC: 9386b \| I/O control for devices (Set for = '')
2018-12-25T12:39:49.30731253Z	61	PC: 9387b \| Open file (See above)
2018-12-25T12:39:49.312784828Z	68	PC: 9386b \| I/O control for devices (See above)
2018-12-25T12:39:49.314598669Z	74	PC: 8f9c4 \| Reallocate memory
2018-12-25T12:39:49.316033522Z	72	PC: 8f9e0 \| Allocate memory
2018-12-25T12:39:49.31873826Z	72	PC: 8f9e4 \| Allocate memory
2018-12-25T12:39:49.320497516Z	74	PC: 8f9fb \| Reallocate memory
2018-12-25T12:39:49.322464809Z	72	PC: 8fa02 \| Allocate memory
2018-12-25T12:39:49.334486424Z	72	PC: 8fa06 \| Allocate memory
2018-12-25T12:39:49.336547241Z	73	PC: 8fa11 \| Release memory
2018-12-25T12:39:49.338592304Z	73	PC: 8efea \| Release memory
2018-12-25T12:39:49.341469685Z	74	PC: 8f003 \| Reallocate memory
2018-12-25T12:39:49.343588584Z	72	PC: 8f054 \| Allocate memory
2018-12-25T12:39:49.345856585Z	72	PC: 8f058 \| Allocate memory
2018-12-25T12:39:49.348645143Z	73	PC: 8f060 \| Release memory
2018-12-25T12:39:49.350871337Z	61	PC: 8f080 \| Open file (Filename = 'r,ï¿½Sï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½[ï¿½
2018-12-25T12:39:49.361313815Z	63	PC: 8f095 \| Read file or device (Read 4 bytes on handle 5)
2018-12-25T12:39:49.367576241Z	66	PC: 8f0ad \| Move file pointer
2018-12-25T12:39:49.370041915Z	62	PC: 8f0d1 \| Close file
2018-12-25T12:39:49.372127897Z	75	PC: 8f0f2 \| Execute program
2018-12-25T12:39:49.39625049Z	80	PC: 12be9 \| Set current PSP
2018-12-25T12:39:49.398025713Z	48	PC: 12bee \| Get DOS version
2018-12-25T12:39:49.399740847Z	99	PC: 193d0 \| Get DBCS lead byte table pointer
2018-12-25T12:39:49.402400162Z	101	PC: 12c74 \| Get extended country info
2018-12-25T12:39:49.404748776Z	99	PC: 12c7a \| Get DBCS lead byte table pointer
2018-12-25T12:39:49.40641092Z	74	PC: 12cdc \| Reallocate memory
2018-12-25T12:39:49.408297187Z	72	PC: 1355d \| Allocate memory
2018-12-25T12:39:49.410820943Z	25	PC: 13596 \| Get default drive
2018-12-25T12:39:49.411931078Z	71	PC: 135ad \| Get current directory
2018-12-25T12:39:49.414408129Z	59	PC: 135ba \| Change current directory
2018-12-25T12:39:49.420554876Z	59	PC: 135c8 \| Change current directory
2018-12-25T12:39:49.427196645Z	59	PC: 135d3 \| Change current directory
2018-12-25T12:39:49.430981484Z	25	PC: 12d13 \| Get default drive
2018-12-25T12:39:49.4320205Z	37	PC: 127d3 \| Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T12:39:49.433984762Z	37	PC: 127da \| Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T12:39:49.435582408Z	37	PC: 127e1 \| Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:39:49.438587321Z	80	PC: 1301d \| Set current PSP
2018-12-25T12:39:49.441842714Z	37	PC: 13041 \| Set interrupt vector (Interrupt = '46' AKA 'Set verify flag')
2018-12-25T12:39:49.443561808Z	53	PC: 13362 \| Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T12:39:49.445172327Z	37	PC: 13383 \| Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T12:39:49.447366852Z	51	PC: 13417 \| Get or set Ctrl-Break
2018-12-25T12:39:49.449450193Z	72	PC: 130ec \| Allocate memory
2018-12-25T12:39:49.451202449Z	61	PC: 131b2 \| Open file (Filename = '')
2018-12-25T12:39:49.459795755Z	62	PC: 131ba \| Close file
2018-12-25T12:39:49.462100755Z	51	PC: 1344c \| Get or set Ctrl-Break
2018-12-25T12:39:49.46339571Z	74	PC: 1197c \| Reallocate memory
2018-12-25T12:39:49.465648934Z	72	PC: 11991 \| Allocate memory
2018-12-25T12:39:49.467819498Z	73	PC: 119b2 \| Release memory
2018-12-25T12:39:49.469736604Z	72	PC: 119bd \| Allocate memory
2018-12-25T12:39:49.472742022Z	73	PC: 119df \| Release memory
2018-12-25T12:39:49.477292807Z	72	PC: 119f5 \| Allocate memory
2018-12-25T12:39:49.479651415Z	72	PC: 119fd \| Allocate memory

{"DateBased":true,"Day":19,"Month":2,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":14116,"SideJobID":0}

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:39:47.105505555Z	255	PC: 12a4a \| UNKNOWN!
2018-12-25T12:39:47.1075437Z	38	PC: 12a71 \| Create PSP
2018-12-25T12:39:47.109310472Z	37	PC: 12a87 \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:47.110925427Z	42	PC: 12a8b \| Get date 0x12a8b: cmp dl, 0x13 0x12a8e: jne 0x12a9b 0x12a90: cmp dh, 1 0x12a93: jne 0x12a98 0x12a95: call 0x12e3c 0x12a98: call 0x12da8 0x12a9b: mov ax, cs 0x12a9d: mov ds, ax 0x12a9f: mov es, ax 0x12aa1: mov si, word ptr [0x103] 0x12aa5: mov di, 0x100 0x12aa8: mov cx, 0x43b 0x12aab: cld 0x12aac: rep movsb byte ptr es:[di], byte ptr [si] 0x12aae: jmp 0x12a40 0x12ab0: inc word ptr [bx + si] 0x12ab2: add byte ptr [bx + si], al 0x12ab4: add byte ptr [bx + si], al 0x12ab6: push ss 0x12ab7: add ax, word ptr [bx + 0x4f]
2018-12-25T12:39:47.114033685Z	9	PC: 12db1 \| Display string (Could not find end pointer)