Sample viewer

vx.netlux.org/Virus.DOS.Vienna.644.a

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:04:51.933918219Z 44 PC: 12f5c | Get time 0x12f5c: pop dx
0x12f5d: cmp cl, 0x14
0x12f60: jb 0x12f65
0x12f62: jmp 0x13128
0x12f65: mov ah, 0x30
0x12f67: int 0x21
0x12f69: cmp al, 1
0x12f6b: jae 0x12f70
0x12f6d: jmp 0x13128
0x12f70: push es
0x12f71: mov ah, 0x2f
0x12f73: int 0x21
0x12f75: mov word ptr [si + 0x313], bx
0x12f79: mov word ptr [si + 0x315], es
0x12f7d: pop es
0x12f7e: mov dx, 0x372
0x12f81: add dx, si
0x12f83: mov ah, 0x1a
0x12f85: int 0x21
0x12f87: push es
2018-12-17T23:04:51.936572972Z 48 PC: 12f69 | Get DOS version
2018-12-17T23:04:51.938724658Z 47 PC: 12f75 | Get disk transfer address
2018-12-17T23:04:51.940473808Z 26 PC: 12f87 | Set disk transfer address
2018-12-17T23:04:51.942228969Z 71 PC: 12fc0 | Get current directory
2018-12-17T23:04:51.94694062Z 78 PC: 13027 | Find first file
2018-12-17T23:04:51.95196013Z 26 PC: 13127 | Set disk transfer address
2018-12-17T23:04:51.953580277Z 9 PC: 12a4c | Display string (String= '(C) 10.90 NEAT This program contains the virus C-644 length program in COM 1280 b ')
2018-12-17T23:04:51.963916676Z 76 PC: 12a50 | Terminate with return code (Return code = '36')