Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Timehalf.6355

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:03:19.742235741Z 53 PC: 139ea | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:03:19.747305903Z 53 PC: 139ea | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:03:19.748547142Z 53 PC: 139ea | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:03:19.749679497Z 53 PC: 139ea | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:03:19.751746168Z 53 PC: 139ea | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:03:19.752933813Z 53 PC: 139ea | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:03:19.754063227Z 53 PC: 139ea | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:03:19.755425504Z 53 PC: 139ea | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:03:19.757006103Z 53 PC: 139ea | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:03:19.75814511Z 53 PC: 139ea | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:03:19.759263184Z 53 PC: 139ea | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:03:19.761202981Z 53 PC: 139ea | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:03:19.762360912Z 53 PC: 139ea | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:03:19.763563431Z 53 PC: 139ea | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:03:19.765593489Z 53 PC: 139ea | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:03:19.767126404Z 53 PC: 139ea | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:03:19.768645313Z 53 PC: 139ea | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:03:19.770538442Z 53 PC: 139ea | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:03:19.771705634Z 53 PC: 139ea | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:03:19.772822559Z 37 PC: 139ff | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:03:19.774757408Z 37 PC: 13a07 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:03:19.776055815Z 37 PC: 13a0f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:03:19.777229159Z 37 PC: 13a17 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:03:19.779585666Z 68 PC: 14763 | I/O control for devices (Set for = '')
2018-12-17T22:03:19.781855284Z 51 PC: 135af | Get or set Ctrl-Break
2018-12-17T22:03:19.783545271Z 48 PC: 1428e | Get DOS version
2018-12-17T22:03:19.786133372Z 42 PC: 13527 | Get date 0x13527: xor ah, ah
0x13529: les di, ptr [bp + 6]
0x1352c: stosw word ptr es:[di], ax
0x1352d: mov al, dl
0x1352f: les di, ptr [bp + 0xa]
0x13532: stosw word ptr es:[di], ax
0x13533: mov al, dh
0x13535: les di, ptr [bp + 0xe]
0x13538: stosw word ptr es:[di], ax
0x13539: xchg ax, cx
0x1353a: les di, ptr [bp + 0x12]
0x1353d: stosw word ptr es:[di], ax
0x1353e: pop bp
0x1353f: retf 0x10
0x13542: push bp
0x13543: mov bp, sp
0x13545: mov cx, word ptr [bp + 0xa]
0x13548: mov dh, byte ptr [bp + 8]
0x1354b: mov dl, byte ptr [bp + 6]
0x1354e: mov ah, 0x2b
2018-12-17T22:03:19.788401302Z 48 PC: 1428e | Get DOS version
2018-12-17T22:03:19.789767814Z 67 PC: 135c2 | Get or set file attributes
2018-12-17T22:03:19.796191127Z 67 PC: 135e9 | Get or set file attributes
2018-12-17T22:03:19.823057011Z 61 PC: 14140 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:03:19.83054624Z 87 PC: 13603 | Get or set file date and time
2018-12-17T22:03:19.833145544Z 63 PC: 14213 | Read file or device (Read 6354 bytes on handle 5)
2018-12-17T22:03:19.841379323Z 44 PC: 1355d | Get time 0x1355d: xor ah, ah
0x1355f: mov al, dl
0x13561: les di, ptr [bp + 6]
0x13564: stosw word ptr es:[di], ax
0x13565: mov al, dh
0x13567: les di, ptr [bp + 0xa]
0x1356a: stosw word ptr es:[di], ax
0x1356b: mov al, cl
0x1356d: les di, ptr [bp + 0xe]
0x13570: stosw word ptr es:[di], ax
0x13571: mov al, ch
0x13573: les di, ptr [bp + 0x12]
0x13576: stosw word ptr es:[di], ax
0x13577: pop bp
0x13578: retf 0x10
0x1357b: push bp
0x1357c: mov bp, sp
0x1357e: mov ch, byte ptr [bp + 0xc]
0x13581: mov cl, byte ptr [bp + 0xa]
0x13584: mov dh, byte ptr [bp + 8]
2018-12-17T22:03:19.848425263Z 64 PC: 13e08 | Write file or device (Write 36 bytes on handle 1)
2018-12-17T22:03:19.85534808Z 64 PC: 13e08 | Write file or device (Write 0 bytes on handle 1)
2018-12-17T22:03:19.857098261Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:03:19.858587901Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:03:19.860523666Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:03:19.862205543Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:03:19.863596041Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:03:19.865230531Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:03:19.867361443Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:03:19.868450005Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:03:19.870084439Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:03:19.871205404Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:03:19.872708109Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:03:19.874249431Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:03:19.875330672Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:03:19.877044212Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:03:19.878806743Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:03:19.893953331Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:03:19.895107256Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:03:19.897493289Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:03:19.898937775Z 37 PC: 13b41 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:03:19.900327232Z 76 PC: 13b80 | Terminate with return code (Return code = '0')