Sample viewer

vx.netlux.org/Virus.DOS.Birth.356

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-17T23:02:51.287982856Z	42	PC: 19e4c \| Get date 0x19e4c: cmp dl, 0x12 0x19e4f: je 0x19e54 0x19e51: jmp 0x19e77 0x19e53: nop 0x19e54: cmp dh, 0xb 0x19e57: je 0x19e5c 0x19e59: jmp 0x19e77 0x19e5b: nop 0x19e5c: mov ah, 9 0x19e5e: mov dx, 0x214 0x19e61: add dx, si 0x19e63: int 0x21 0x19e65: mov bx, 0x9999 0x19e68: mov cx, 0x9999 0x19e6b: sub cx, 1 0x19e6e: jne 0x19e6b 0x19e70: sub bx, 1 0x19e73: jne 0x19e68 0x19e75: int 0x19 0x19e77: mov ah, 0x1a
2018-12-17T23:02:51.290280854Z	26	PC: 19e80 \| Set disk transfer address
2018-12-17T23:02:51.291580169Z	78	PC: 19e8c \| Find first file
2018-12-17T23:02:51.29566754Z	61	PC: 19eab \| Open file (Filename = 'SLEEP.COM')
2018-12-17T23:02:51.300470168Z	63	PC: 19ebb \| Read file or device (Read 5 bytes on handle 5)
2018-12-17T23:02:51.305381692Z	66	PC: 19ef1 \| Move file pointer
2018-12-17T23:02:51.306769548Z	64	PC: 19f2f \| Write file or device (Write 5 bytes on handle 5)
2018-12-17T23:02:51.309239392Z	66	PC: 19f3a \| Move file pointer
2018-12-17T23:02:51.310539728Z	64	PC: 19f49 \| Write file or device (Write 356 bytes on handle 5)
2018-12-17T23:02:51.323444993Z	62	PC: 19edd \| Close file

{"DateBased":true,"Day":18,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":14340,"SideJobID":0}

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:40:18.408079817Z	42	PC: 19e4c \| Get date 0x19e4c: cmp dl, 0x12 0x19e4f: je 0x19e54 0x19e51: jmp 0x19e77 0x19e53: nop 0x19e54: cmp dh, 0xb 0x19e57: je 0x19e5c 0x19e59: jmp 0x19e77 0x19e5b: nop 0x19e5c: mov ah, 9 0x19e5e: mov dx, 0x214 0x19e61: add dx, si 0x19e63: int 0x21 0x19e65: mov bx, 0x9999 0x19e68: mov cx, 0x9999 0x19e6b: sub cx, 1 0x19e6e: jne 0x19e6b 0x19e70: sub bx, 1 0x19e73: jne 0x19e68 0x19e75: int 0x19 0x19e77: mov ah, 0x1a
2018-12-25T12:40:18.410767861Z	26	PC: 19e80 \| Set disk transfer address
2018-12-25T12:40:18.413436676Z	78	PC: 19e8c \| Find first file
2018-12-25T12:40:18.420232901Z	61	PC: 19eab \| Open file (Filename = 'SLEEP.COM')
2018-12-25T12:40:18.427492446Z	63	PC: 19ebb \| Read file or device (Read 5 bytes on handle 5)
2018-12-25T12:40:18.435481897Z	66	PC: 19ef1 \| Move file pointer
2018-12-25T12:40:18.436966187Z	64	PC: 19f2f \| Write file or device (Write 5 bytes on handle 5)
2018-12-25T12:40:18.442437369Z	66	PC: 19f3a \| Move file pointer
2018-12-25T12:40:18.44606636Z	64	PC: 19f49 \| Write file or device (Write 356 bytes on handle 5)
2018-12-25T12:40:18.462483302Z	62	PC: 19edd \| Close file

{"DateBased":true,"Day":18,"Month":11,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":14340,"SideJobID":0}

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:40:18.634240649Z	42	PC: 19e4c \| Get date 0x19e4c: cmp dl, 0x12 0x19e4f: je 0x19e54 0x19e51: jmp 0x19e77 0x19e53: nop 0x19e54: cmp dh, 0xb 0x19e57: je 0x19e5c 0x19e59: jmp 0x19e77 0x19e5b: nop 0x19e5c: mov ah, 9 0x19e5e: mov dx, 0x214 0x19e61: add dx, si 0x19e63: int 0x21 0x19e65: mov bx, 0x9999 0x19e68: mov cx, 0x9999 0x19e6b: sub cx, 1 0x19e6e: jne 0x19e6b 0x19e70: sub bx, 1 0x19e73: jne 0x19e68 0x19e75: int 0x19 0x19e77: mov ah, 0x1a
2018-12-25T12:40:18.637576944Z	9	PC: 19e65 \| Display string (String= ' Birthday Virus Ver 1.00 Many Happy Returns Of The Day to U.P. ')
2018-12-25T12:40:24.956179481Z	72	PC: 8f1b9 \| Allocate memory
2018-12-25T12:40:24.957934735Z	72	PC: 8f1bd \| Allocate memory
2018-12-25T12:40:24.961150787Z	99	PC: 90858 \| Get DBCS lead byte table pointer
2018-12-25T12:40:24.963886336Z	61	PC: 91f88 \| Open file (Filename = 'C:\WINDOWS\HIMEM.SYS')
2018-12-25T12:40:24.974895934Z	66	PC: 91f95 \| Move file pointer
2018-12-25T12:40:24.977252665Z	62	PC: 91fc1 \| Close file
2018-12-25T12:40:24.979256842Z	75	PC: 91fe0 \| Execute program
2018-12-25T12:40:24.996536993Z	98	PC: 916f1 \| Get current PSP
2018-12-25T12:40:24.998646471Z	9	PC: c605 \| Display string (String= '6��r�&;]u')
2018-12-25T12:40:25.007766347Z	48	PC: c609 \| Get DOS version
2018-12-25T12:40:25.010813874Z	9	PC: c382 \| Display string (String= ' Installed A20 handler number ')
2018-12-25T12:40:25.015999867Z	2	PC: c38c \| Character output (Char = '32')
2018-12-25T12:40:25.019091508Z	2	PC: c3a7 \| Character output (Char = '2e')
2018-12-25T12:40:25.023152703Z	9	PC: c6d9 \| Display string (String= '��VH�VD��V@����_��Ku��t1��D��t �� a1��Z��W��5��\|��(��ǋ�(��p�^')
2018-12-25T12:40:25.030526354Z	9	PC: c6e0 \| Display string (String= '�5��\|��(��ǋ�(��p�^')
2018-12-25T12:40:25.042258918Z	61	PC: 91f88 \| Open file (See above)
2018-12-25T12:40:25.052675636Z	66	PC: 91f95 \| Move file pointer (See above)
2018-12-25T12:40:25.054674498Z	62	PC: 91fc1 \| Close file (See above)
2018-12-25T12:40:25.057649643Z	75	PC: 91fe0 \| Execute program (See above)
2018-12-25T12:40:25.082013176Z	98	PC: 916f1 \| Get current PSP (See above)
2018-12-25T12:40:25.086293005Z	82	PC: 13d46 \| Get DOS internal pointers (SYSVARS)
2018-12-25T12:40:25.087965455Z	53	PC: 13ac3 \| Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T12:40:25.08894796Z	37	PC: 13ad6 \| Set interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T12:40:25.090995017Z	53	PC: 13ae0 \| Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T12:40:25.09206285Z	37	PC: 13af3 \| Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T12:40:25.093036578Z	9	PC: 13a0d \| Display string (Could not find end pointer)
2018-12-25T12:40:25.103348194Z	62	PC: 8f8eb \| Close file
2018-12-25T12:40:25.105146098Z	62	PC: 8f8f2 \| Close file
2018-12-25T12:40:25.106735381Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.109290567Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.123765668Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.125143061Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.126697297Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.128436094Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.129772004Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.131342107Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.134273343Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.135832508Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.137273493Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.139238936Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.140837654Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.142380842Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.144215334Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.145618146Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.147312097Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.150218478Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.151885755Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.153531046Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.155762878Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.156721601Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.157643782Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.159121156Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.160344679Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.161511712Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.163030776Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.164158258Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.165221372Z	62	PC: 8f8f2 \| Close file (See above)
2018-12-25T12:40:25.166810583Z	61	PC: 8f8ff \| Open file (Filename = '')
2018-12-25T12:40:25.169883686Z	62	PC: 8f90e \| Close file
2018-12-25T12:40:25.171169148Z	69	PC: 8f915 \| Duplicate handle
2018-12-25T12:40:25.172922521Z	69	PC: 8f919 \| Duplicate handle
2018-12-25T12:40:25.174078526Z	61	PC: 9387b \| Open file (Filename = '')
2018-12-25T12:40:25.177015848Z	68	PC: 9386b \| I/O control for devices (Set for = '')
2018-12-25T12:40:25.178768015Z	61	PC: 9387b \| Open file (See above)
2018-12-25T12:40:25.182047987Z	68	PC: 9386b \| I/O control for devices (See above)
2018-12-25T12:40:25.183233211Z	74	PC: 8f9c4 \| Reallocate memory
2018-12-25T12:40:25.184773849Z	72	PC: 8f9e0 \| Allocate memory
2018-12-25T12:40:25.186246845Z	72	PC: 8f9e4 \| Allocate memory
2018-12-25T12:40:25.187520514Z	74	PC: 8f9fb \| Reallocate memory
2018-12-25T12:40:25.188990001Z	72	PC: 8fa02 \| Allocate memory
2018-12-25T12:40:25.190163884Z	72	PC: 8fa06 \| Allocate memory
2018-12-25T12:40:25.191241104Z	73	PC: 8fa11 \| Release memory
2018-12-25T12:40:25.192869309Z	73	PC: 8efea \| Release memory
2018-12-25T12:40:25.193797636Z	74	PC: 8f003 \| Reallocate memory
2018-12-25T12:40:25.194854983Z	72	PC: 8f054 \| Allocate memory
2018-12-25T12:40:25.196695223Z	72	PC: 8f058 \| Allocate memory
2018-12-25T12:40:25.197696916Z	73	PC: 8f060 \| Release memory
2018-12-25T12:40:25.198617863Z	61	PC: 8f080 \| Open file (Filename = '')
2018-12-25T12:40:25.204498797Z	63	PC: 8f095 \| Read file or device (Read 4 bytes on handle 5)
2018-12-25T12:40:25.207839087Z	66	PC: 8f0ad \| Move file pointer
2018-12-25T12:40:25.208832458Z	62	PC: 8f0d1 \| Close file
2018-12-25T12:40:25.210582823Z	75	PC: 8f0f2 \| Execute program
2018-12-25T12:40:25.226409197Z	80	PC: 12be9 \| Set current PSP
2018-12-25T12:40:25.227171525Z	48	PC: 12bee \| Get DOS version
2018-12-25T12:40:25.228878899Z	99	PC: 193d0 \| Get DBCS lead byte table pointer
2018-12-25T12:40:25.230617668Z	101	PC: 12c74 \| Get extended country info
2018-12-25T12:40:25.231566004Z	99	PC: 12c7a \| Get DBCS lead byte table pointer
2018-12-25T12:40:25.233043098Z	74	PC: 12cdc \| Reallocate memory
2018-12-25T12:40:25.234206894Z	72	PC: 1355d \| Allocate memory
2018-12-25T12:40:25.235429407Z	25	PC: 13596 \| Get default drive
2018-12-25T12:40:25.236856658Z	71	PC: 135ad \| Get current directory
2018-12-25T12:40:25.238483931Z	59	PC: 135ba \| Change current directory
2018-12-25T12:40:25.241777839Z	59	PC: 135c8 \| Change current directory
2018-12-25T12:40:25.245829341Z	59	PC: 135d3 \| Change current directory
2018-12-25T12:40:25.248172292Z	25	PC: 12d13 \| Get default drive
2018-12-25T12:40:25.249163949Z	37	PC: 127d3 \| Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T12:40:25.250638044Z	37	PC: 127da \| Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T12:40:25.251604102Z	37	PC: 127e1 \| Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:40:25.253081018Z	80	PC: 1301d \| Set current PSP
2018-12-25T12:40:25.254394795Z	37	PC: 13041 \| Set interrupt vector (Interrupt = '46' AKA 'Set verify flag')
2018-12-25T12:40:25.255835646Z	53	PC: 13362 \| Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T12:40:25.256868382Z	37	PC: 13383 \| Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T12:40:25.258382164Z	51	PC: 13417 \| Get or set Ctrl-Break
2018-12-25T12:40:25.259692207Z	72	PC: 130ec \| Allocate memory
2018-12-25T12:40:25.261043073Z	61	PC: 131b2 \| Open file (Filename = '')
2018-12-25T12:40:25.26547973Z	62	PC: 131ba \| Close file
2018-12-25T12:40:25.266988033Z	51	PC: 1344c \| Get or set Ctrl-Break
2018-12-25T12:40:25.268045875Z	74	PC: 1197c \| Reallocate memory
2018-12-25T12:40:25.269695584Z	72	PC: 11991 \| Allocate memory
2018-12-25T12:40:25.270871105Z	73	PC: 119b2 \| Release memory
2018-12-25T12:40:25.271942378Z	72	PC: 119bd \| Allocate memory
2018-12-25T12:40:25.273760187Z	73	PC: 119df \| Release memory
2018-12-25T12:40:25.274760083Z	72	PC: 119f5 \| Allocate memory
2018-12-25T12:40:25.275965873Z	72	PC: 119fd \| Allocate memory

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":14340,"SideJobID":0}

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:40:18.492108876Z	42	PC: 19e4c \| Get date 0x19e4c: cmp dl, 0x12 0x19e4f: je 0x19e54 0x19e51: jmp 0x19e77 0x19e53: nop 0x19e54: cmp dh, 0xb 0x19e57: je 0x19e5c 0x19e59: jmp 0x19e77 0x19e5b: nop 0x19e5c: mov ah, 9 0x19e5e: mov dx, 0x214 0x19e61: add dx, si 0x19e63: int 0x21 0x19e65: mov bx, 0x9999 0x19e68: mov cx, 0x9999 0x19e6b: sub cx, 1 0x19e6e: jne 0x19e6b 0x19e70: sub bx, 1 0x19e73: jne 0x19e68 0x19e75: int 0x19 0x19e77: mov ah, 0x1a
2018-12-25T12:40:18.495855558Z	26	PC: 19e80 \| Set disk transfer address
2018-12-25T12:40:18.497425925Z	78	PC: 19e8c \| Find first file
2018-12-25T12:40:18.50430585Z	61	PC: 19eab \| Open file (Filename = 'SLEEP.COM')
2018-12-25T12:40:18.512737102Z	63	PC: 19ebb \| Read file or device (Read 5 bytes on handle 5)
2018-12-25T12:40:18.520759106Z	66	PC: 19ef1 \| Move file pointer
2018-12-25T12:40:18.522554874Z	64	PC: 19f2f \| Write file or device (Write 5 bytes on handle 5)
2018-12-25T12:40:18.526641478Z	66	PC: 19f3a \| Move file pointer
2018-12-25T12:40:18.528604329Z	64	PC: 19f49 \| Write file or device (Write 356 bytes on handle 5)
2018-12-25T12:40:18.544510388Z	62	PC: 19edd \| Close file