Sample viewer

vx.netlux.org/Virus.DOS.HLLO.3855.b

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:03:31.454118909Z 53 PC: 132ba | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:31.458266529Z 53 PC: 132ba | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:31.459743675Z 53 PC: 132ba | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:31.461163666Z 53 PC: 132ba | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:31.462597951Z 53 PC: 132ba | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:31.469349499Z 53 PC: 132ba | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:31.470713498Z 53 PC: 132ba | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:31.472082408Z 53 PC: 132ba | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:31.478199859Z 53 PC: 132ba | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:31.479479465Z 53 PC: 132ba | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:31.480727505Z 53 PC: 132ba | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:31.482494025Z 53 PC: 132ba | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:31.483964975Z 53 PC: 132ba | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:31.48546898Z 53 PC: 132ba | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:31.494822994Z 53 PC: 132ba | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:31.496275374Z 53 PC: 132ba | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:31.498293284Z 53 PC: 132ba | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:31.500794234Z 53 PC: 132ba | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:31.502169295Z 53 PC: 132ba | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:31.50351507Z 37 PC: 132cf | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:31.505068416Z 37 PC: 132d7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:31.507598498Z 37 PC: 132df | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:31.509911874Z 37 PC: 132e7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:31.512540439Z 68 PC: 13da3 | I/O control for devices (Set for = '')
2018-12-17T23:03:31.515421114Z 44 PC: 13eda | Get time 0x13eda: mov word ptr [0x3e], cx
0x13ede: mov word ptr [0x40], dx
0x13ee2: retf
0x13ee3: mov bx, sp
0x13ee5: mov al, byte ptr ss:[bx + 4]
0x13ee9: cmp al, 0x61
0x13eeb: jb 0x13ef3
0x13eed: cmp al, 0x7a
0x13eef: ja 0x13ef3
0x13ef1: sub al, 0x20
0x13ef3: retf 2
0x13ef6: mov di, 0x52
0x13ef9: push ds
0x13efa: pop es
0x13efb: mov cx, 0x2a0
0x13efe: sub cx, di
0x13f00: shr cx, 1
0x13f02: xor ax, ax
0x13f04: cld
0x13f05: rep stosd dword ptr es:[di], eax
2018-12-17T23:03:31.51987223Z 26 PC: 13205 | Set disk transfer address
2018-12-17T23:03:31.522334102Z 78 PC: 13211 | Find first file
2018-12-17T23:03:31.531093174Z 61 PC: 13980 | Open file (Filename = 'TEST.EXE')
2018-12-17T23:03:31.538745071Z 48 PC: 13ace | Get DOS version
2018-12-17T23:03:31.540817361Z 61 PC: 13980 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:31.549474575Z 63 PC: 13a12 | Read file or device (Read 3855 bytes on handle 5)
2018-12-17T23:03:31.558225816Z 63 PC: 13a12 | Read file or device (Read 3855 bytes on handle 6)
2018-12-17T23:03:31.566365341Z 26 PC: 13229 | Set disk transfer address
2018-12-17T23:03:31.574529628Z 79 PC: 1322e | Find next file
2018-12-17T23:03:31.5776109Z 61 PC: 13980 | Open file (Filename = 'TEST.EXE')
2018-12-17T23:03:31.584923807Z 48 PC: 13ace | Get DOS version
2018-12-17T23:03:31.587413655Z 61 PC: 13980 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:31.595740043Z 63 PC: 13a12 | Read file or device (Read 3855 bytes on handle 7)
2018-12-17T23:03:31.604136616Z 63 PC: 13a12 | Read file or device (Read 3855 bytes on handle 8)
2018-12-17T23:03:31.614466332Z 64 PC: 136d8 | Write file or device (Write 26 bytes on handle 1)
2018-12-17T23:03:31.619846474Z 64 PC: 136d8 | Write file or device (Write 0 bytes on handle 1)
2018-12-17T23:03:31.621789452Z 37 PC: 13411 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:31.623099447Z 37 PC: 13411 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:31.625440612Z 37 PC: 13411 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:31.62708434Z 37 PC: 13411 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:31.628718871Z 37 PC: 13411 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:31.630721388Z 37 PC: 13411 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:31.632058039Z 37 PC: 13411 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:31.633362377Z 37 PC: 13411 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:31.635723023Z 37 PC: 13411 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:31.637069916Z 37 PC: 13411 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:31.638397021Z 37 PC: 13411 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:31.640470051Z 37 PC: 13411 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:31.64204102Z 37 PC: 13411 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:31.643548335Z 37 PC: 13411 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:31.645996786Z 37 PC: 13411 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:31.647537592Z 37 PC: 13411 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:31.649071267Z 37 PC: 13411 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:31.650803501Z 37 PC: 13411 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:31.652989539Z 37 PC: 13411 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:31.654613802Z 76 PC: 13450 | Terminate with return code (Return code = '0')