Sample viewer

vx.netlux.org/Virus.DOS.PeaceKeeper.c

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:04:11.352890066Z 48 PC: 12be9 | Get DOS version
2018-12-17T23:04:11.354454914Z 222 PC: 12bfc | UNKNOWN!
2018-12-17T23:04:11.362092396Z 53 PC: 12c29 | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-17T23:04:11.363114212Z 53 PC: 12c36 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:04:11.377216578Z 52 PC: 12b7e | Get InDOS flag pointer
2018-12-17T23:04:11.378759264Z 42 PC: 12c6b | Get date 0x12c6b: mov byte ptr [si + 0xa84], dh
0x12c6f: mov bx, word ptr [si + 0xa34]
0x12c73: dec bx
0x12c74: mov es, bx
0x12c76: sub bx, bx
0x12c78: cmp byte ptr es:[bx], 0x5a
0x12c7c: je 0x12c81
0x12c7e: jmp 0x12b1c
0x12c81: mov ax, 0x184
0x12c84: sub word ptr es:[bx + 3], ax
0x12c88: sub word ptr es:[bx + 0x12], ax
0x12c8c: mov es, word ptr es:[bx + 0x12]
0x12c90: push si
0x12c91: sub cx, cx
0x12c93: sub di, di
0x12c95: or di, 0x100
0x12c99: or cx, 0xeeb
0x12c9d: rep movsb byte ptr es:[di], byte ptr [si]
0x12c9f: pop si
0x12ca0: mov ax, 0x2521
2018-12-17T23:04:11.381084581Z 18 PC: 12b53 | Find next file
2018-12-17T23:04:11.405208113Z 89 PC: 15fa8 | Get extended error info
2018-12-17T23:04:11.409997354Z 64 PC: 19838 | Write file or device (Write 8 bytes on handle 2)
2018-12-17T23:04:11.41344132Z 64 PC: 19838 | Write file or device (Write 2 bytes on handle 2)
2018-12-17T23:04:11.416428989Z 100 PC: 19d8b | Set wait for external event flag
2018-12-17T23:04:11.41794237Z 26 PC: 1795c | Set disk transfer address
2018-12-17T23:04:11.41903901Z 18 PC: 17963 | Find next file
2018-12-17T23:04:11.420597401Z 89 PC: 15fa8 | Get extended error info
2018-12-17T23:04:11.423024704Z 59 PC: 1676b | Change current directory