Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Viper.7792

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:03:32.882557989Z 53 PC: 136da | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:32.885816118Z 53 PC: 136da | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:32.88745685Z 53 PC: 136da | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:32.889047134Z 53 PC: 136da | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:32.892071135Z 53 PC: 136da | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:32.894230979Z 53 PC: 136da | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:32.896220835Z 53 PC: 136da | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:32.898019539Z 53 PC: 136da | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:32.903057332Z 53 PC: 136da | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:32.905414978Z 53 PC: 136da | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:32.90746586Z 53 PC: 136da | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:32.909288472Z 53 PC: 136da | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:32.910878276Z 53 PC: 136da | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:32.912745951Z 53 PC: 136da | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:32.918335357Z 53 PC: 136da | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:32.919578471Z 53 PC: 136da | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:32.920759096Z 53 PC: 136da | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:32.925719367Z 53 PC: 136da | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:32.92699328Z 53 PC: 136da | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:32.928306594Z 37 PC: 136ef | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:32.93132141Z 37 PC: 136f7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:32.932642593Z 37 PC: 136ff | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:32.933895984Z 37 PC: 13707 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:32.935933773Z 68 PC: 14497 | I/O control for devices (Set for = '��I�� ')
2018-12-17T23:03:32.939064011Z 48 PC: 13fc2 | Get DOS version
2018-12-17T23:03:32.942701628Z 61 PC: 13e00 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:32.9490939Z 87 PC: 13410 | Get or set file date and time
2018-12-17T23:03:32.952370497Z 60 PC: 13e00 | Create or truncate file
2018-12-17T23:03:32.967306699Z 66 PC: 13f32 | Move file pointer
2018-12-17T23:03:32.969216285Z 63 PC: 13ed3 | Read file or device (Read 7792 bytes on handle 5)
2018-12-17T23:03:32.971913495Z 66 PC: 14596 | Move file pointer
2018-12-17T23:03:32.973400561Z 66 PC: 145a4 | Move file pointer
2018-12-17T23:03:32.974834085Z 66 PC: 145b2 | Move file pointer
2018-12-17T23:03:32.977281715Z 62 PC: 13e50 | Close file
2018-12-17T23:03:32.979353278Z 87 PC: 1343d | Get or set file date and time
2018-12-17T23:03:32.982125887Z 62 PC: 13e50 | Close file
2018-12-17T23:03:33.004743322Z 67 PC: 133cf | Get or set file attributes
2018-12-17T23:03:33.011722211Z 61 PC: 13e00 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:33.018831477Z 87 PC: 13410 | Get or set file date and time
2018-12-17T23:03:33.02164853Z 63 PC: 13ed3 | Read file or device (Read 7792 bytes on handle 5)
2018-12-17T23:03:33.03391198Z 66 PC: 13f32 | Move file pointer
2018-12-17T23:03:33.039084911Z 64 PC: 13ed3 | Write file or device (Write 1 bytes on handle 5)
2018-12-17T23:03:33.043005991Z 87 PC: 1343d | Get or set file date and time
2018-12-17T23:03:33.04586387Z 62 PC: 13e50 | Close file
2018-12-17T23:03:33.053695143Z 67 PC: 133f6 | Get or set file attributes
2018-12-17T23:03:33.065518596Z 26 PC: 1346d | Set disk transfer address
2018-12-17T23:03:33.067234909Z 78 PC: 13479 | Find first file
2018-12-17T23:03:33.077271913Z 61 PC: 13e00 | Open file (Filename = 'C:\DOS\ATTRIB.EXE')
2018-12-17T23:03:33.085849652Z 63 PC: 13ed3 | Read file or device (Read 27 bytes on handle 5)
2018-12-17T23:03:33.092418288Z 62 PC: 13e50 | Close file
2018-12-17T23:03:33.095194261Z 60 PC: 13e00 | Create or truncate file
2018-12-17T23:03:33.435718758Z 67 PC: 133cf | Get or set file attributes
2018-12-17T23:03:33.442872531Z 61 PC: 13e00 | Open file (Filename = 'C:\DOS\ATTRIB.EXE')
2018-12-17T23:03:33.449757429Z 87 PC: 13410 | Get or set file date and time
2018-12-17T23:03:33.451497498Z 64 PC: 13ed3 | Write file or device (Write 7792 bytes on handle 5)
2018-12-17T23:03:33.46269175Z 63 PC: 13ed3 | Read file or device (Read 7792 bytes on handle 6)
2018-12-17T23:03:33.470967108Z 64 PC: 13ed3 | Write file or device (Write 7792 bytes on handle 5)
2018-12-17T23:03:33.484406786Z 66 PC: 14596 | Move file pointer
2018-12-17T23:03:33.487601059Z 66 PC: 145a4 | Move file pointer
2018-12-17T23:03:33.489648801Z 66 PC: 145b2 | Move file pointer
2018-12-17T23:03:33.49180006Z 63 PC: 13ed3 | Read file or device (Read 7792 bytes on handle 6)
2018-12-17T23:03:33.5006182Z 64 PC: 13ed3 | Write file or device (Write 3416 bytes on handle 5)
2018-12-17T23:03:33.509758088Z 66 PC: 14596 | Move file pointer
2018-12-17T23:03:33.511466763Z 66 PC: 145a4 | Move file pointer
2018-12-17T23:03:33.514883098Z 66 PC: 145b2 | Move file pointer
2018-12-17T23:03:33.516536644Z 62 PC: 13e50 | Close file
2018-12-17T23:03:33.518585336Z 87 PC: 1343d | Get or set file date and time
2018-12-17T23:03:33.531630973Z 62 PC: 13e50 | Close file
2018-12-17T23:03:33.538856619Z 65 PC: 13f49 | Delete file (Filename = 'C:\DOS\ATTRIB.EXE')
2018-12-17T23:03:33.556708435Z 86 PC: 13f8d | Rename file
2018-12-17T23:03:33.568811129Z 67 PC: 133f6 | Get or set file attributes
2018-12-17T23:03:33.583819774Z 26 PC: 13491 | Set disk transfer address
2018-12-17T23:03:33.585161495Z 79 PC: 13496 | Find next file
2018-12-17T23:03:33.591675861Z 26 PC: 1346d | Set disk transfer address
2018-12-17T23:03:33.593445683Z 78 PC: 13479 | Find first file
2018-12-17T23:03:33.603769338Z 41 PC: 1363c | Parse filename
2018-12-17T23:03:33.605468181Z 41 PC: 1364a | Parse filename
2018-12-17T23:03:33.607995188Z 75 PC: 13655 | Execute program
2018-12-17T23:03:33.616916026Z 65 PC: 13f49 | Delete file (Filename = 'A:\$viper$.TmP')
2018-12-17T23:03:33.628073264Z 64 PC: 13d5b | Write file or device (Write 0 bytes on handle 1)
2018-12-17T23:03:33.631674352Z 37 PC: 13831 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:33.63281412Z 37 PC: 13831 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:33.633939256Z 37 PC: 13831 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:33.636726742Z 37 PC: 13831 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:33.637866464Z 37 PC: 13831 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:33.639010371Z 37 PC: 13831 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:33.641372734Z 37 PC: 13831 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:33.642463477Z 37 PC: 13831 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:33.644300671Z 37 PC: 13831 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:33.646334677Z 37 PC: 13831 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:33.64748637Z 37 PC: 13831 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:33.648750335Z 37 PC: 13831 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:33.651246462Z 37 PC: 13831 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:33.652386596Z 37 PC: 13831 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:33.653598565Z 37 PC: 13831 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:33.656114103Z 37 PC: 13831 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:33.657270861Z 37 PC: 13831 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:33.658813934Z 37 PC: 13831 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:33.661656029Z 37 PC: 13831 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:33.662965441Z 76 PC: 13870 | Terminate with return code (Return code = '0')