Sample viewer

vx.netlux.org/Virus.DOS.Mephisto.3.928

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:02:36.893709101Z 53 PC: 12b71 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:02:36.896259488Z 47 PC: 12c1f | Get disk transfer address
2018-12-17T23:02:36.897688559Z 25 PC: 12c2b | Get default drive
2018-12-17T23:02:36.898712562Z 71 PC: 12c3e | Get current directory
2018-12-17T23:02:36.901757888Z 26 PC: 12c54 | Set disk transfer address
2018-12-17T23:02:36.903064974Z 78 PC: 12c5f | Find first file
2018-12-17T23:02:36.909094292Z 61 PC: 12d16 | Open file (Filename = 'SLEEP.COM')
2018-12-17T23:02:36.91586212Z 44 PC: 12d1e | Get time 0x12d1e: mov word ptr [bp + 0x47b], dx
0x12d22: mov word ptr [bp + 0x47d], cx
0x12d26: xor dh, ch
0x12d28: xor cl, dl
0x12d2a: mov ch, dh
0x12d2c: mov word ptr [bp + 0x47f], cx
0x12d30: mov ax, 0x4300
0x12d33: lea dx, word ptr [bp + 0x139]
0x12d37: int 0x21
0x12d39: mov word ptr [bp + 0x172], cx
0x12d3d: mov ax, 0x5700
0x12d40: mov bx, word ptr [bp + 0x16d]
0x12d44: int 0x21
0x12d46: mov word ptr [bp + 0x170], dx
0x12d4a: mov word ptr [bp + 0x16e], cx
0x12d4e: mov ax, 0x4301
0x12d51: mov cx, 0
0x12d54: int 0x21
0x12d56: mov ah, 0x3f
0x12d58: mov cx, 3
2018-12-17T23:02:36.918821693Z 67 PC: 12d39 | Get or set file attributes
2018-12-17T23:02:36.925140946Z 87 PC: 12d46 | Get or set file date and time
2018-12-17T23:02:36.927035204Z 67 PC: 12d56 | Get or set file attributes
2018-12-17T23:02:36.937811307Z 53 PC: 12b85 | Get interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T23:02:36.939019875Z 37 PC: 12b91 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:02:36.940629144Z 63 PC: 12d64 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T23:02:36.959637624Z 37 PC: 12ba5 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:02:36.961752433Z 66 PC: 12d77 | Move file pointer
2018-12-17T23:02:36.963726338Z 66 PC: 12d8b | Move file pointer
2018-12-17T23:02:36.966941791Z 64 PC: 12d97 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T23:02:36.969700607Z 66 PC: 12da2 | Move file pointer
2018-12-17T23:02:36.971160486Z 53 PC: 12b85 | Get interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T23:02:36.973787308Z 37 PC: 12b91 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:02:36.975490635Z 64 PC: 12ddd | Write file or device (Write 928 bytes on handle 5)
2018-12-17T23:02:36.991799318Z 67 PC: 12bb9 | Get or set file attributes
2018-12-17T23:02:37.00188944Z 87 PC: 12bcc | Get or set file date and time
2018-12-17T23:02:37.004268637Z 62 PC: 12bd0 | Close file
2018-12-17T23:02:37.012333214Z 37 PC: 12ba5 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:02:37.014100516Z 59 PC: 12bdb | Change current directory
2018-12-17T23:02:37.016282783Z 26 PC: 12c02 | Set disk transfer address
2018-12-17T23:02:37.017354278Z 0 PC: 12a43 | Program terminate