Sample viewer

vx.netlux.org/Virus.DOS.Christmas.1694

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-17T23:05:09.394054973Z	53	PC: 12a64 \| Get interrupt vector (Interrupt = '99' AKA 'Get DBCS lead byte table pointer')
2018-12-17T23:05:09.396003948Z	53	PC: 12a73 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:09.39805753Z	74	PC: 12b01 \| Reallocate memory
2018-12-17T23:05:09.39986002Z	37	PC: 12b09 \| Set interrupt vector (Interrupt = '99' AKA 'Get DBCS lead byte table pointer')
2018-12-17T23:05:09.401174953Z	37	PC: 12b11 \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:09.406651552Z	42	PC: 12b18 \| Get date 0x12b18: cmp dh, 0xc 0x12b1b: jne 0x12b4e 0x12b1d: cmp dl, 0x17 0x12b20: jbe 0x12b4e 0x12b22: cmp dl, 0x1b 0x12b25: jae 0x12b4e 0x12b27: mov ax, 0x3508 0x12b2a: pushf 0x12b2b: lcall ptr [0x5e2] 0x12b2f: mov word ptr [0x5ec], es 0x12b33: mov word ptr [0x5ea], bx 0x12b37: mov dx, 0x190 0x12b3a: mov ax, 0x2508 0x12b3d: pushf 0x12b3e: lcall ptr [0x5e2] 0x12b42: mov word ptr [0x272], 0 0x12b48: mov word ptr [0x273], 0 0x12b4e: mov ax, ds 0x12b50: mov es, ax 0x12b52: sub ax, 0x10
2018-12-17T23:05:09.409372789Z	75	PC: 12b6c \| Execute program
2018-12-17T23:05:09.42543309Z	53	PC: 13264 \| Get interrupt vector (Interrupt = '99' AKA 'Get DBCS lead byte table pointer')
2018-12-17T23:05:09.427316873Z	76	PC: 13244 \| Terminate with return code (Return code = '0')
2018-12-17T23:05:09.432339348Z	49	PC: 12b91 \| Terminate and stay resident (Return code = '92' \| Memory size = '122')

{"DateBased":true,"Day":23,"Month":12,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15118,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:42:41.081297553Z	53	PC: 12a64 \| Get interrupt vector (Interrupt = '99' AKA 'Get DBCS lead byte table pointer')
2018-12-25T12:42:41.082683315Z	53	PC: 12a73 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:42:41.085225453Z	74	PC: 12b01 \| Reallocate memory
2018-12-25T12:42:41.088082839Z	37	PC: 12b09 \| Set interrupt vector (Interrupt = '99' AKA 'Get DBCS lead byte table pointer')
2018-12-25T12:42:41.093661442Z	37	PC: 12b11 \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:42:41.094732286Z	42	PC: 12b18 \| Get date 0x12b18: cmp dh, 0xc 0x12b1b: jne 0x12b4e 0x12b1d: cmp dl, 0x17 0x12b20: jbe 0x12b4e 0x12b22: cmp dl, 0x1b 0x12b25: jae 0x12b4e 0x12b27: mov ax, 0x3508 0x12b2a: pushf 0x12b2b: lcall ptr [0x5e2] 0x12b2f: mov word ptr [0x5ec], es 0x12b33: mov word ptr [0x5ea], bx 0x12b37: mov dx, 0x190 0x12b3a: mov ax, 0x2508 0x12b3d: pushf 0x12b3e: lcall ptr [0x5e2] 0x12b42: mov word ptr [0x272], 0 0x12b48: mov word ptr [0x273], 0 0x12b4e: mov ax, ds 0x12b50: mov es, ax 0x12b52: sub ax, 0x10
2018-12-25T12:42:41.097829322Z	75	PC: 12b6c \| Execute program
2018-12-25T12:42:41.115167019Z	53	PC: 13264 \| Get interrupt vector (Interrupt = '99' AKA 'Get DBCS lead byte table pointer')
2018-12-25T12:42:41.116333645Z	76	PC: 13244 \| Terminate with return code (Return code = '0')
2018-12-25T12:42:41.11914962Z	49	PC: 12b91 \| Terminate and stay resident (Return code = '92' \| Memory size = '122')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15118,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:42:41.510093765Z	53	PC: 12a64 \| Get interrupt vector (Interrupt = '99' AKA 'Get DBCS lead byte table pointer')
2018-12-25T12:42:41.511637079Z	53	PC: 12a73 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:42:41.513682186Z	74	PC: 12b01 \| Reallocate memory
2018-12-25T12:42:41.514769866Z	37	PC: 12b09 \| Set interrupt vector (Interrupt = '99' AKA 'Get DBCS lead byte table pointer')
2018-12-25T12:42:41.515617001Z	37	PC: 12b11 \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:42:41.517559888Z	42	PC: 12b18 \| Get date 0x12b18: cmp dh, 0xc 0x12b1b: jne 0x12b4e 0x12b1d: cmp dl, 0x17 0x12b20: jbe 0x12b4e 0x12b22: cmp dl, 0x1b 0x12b25: jae 0x12b4e 0x12b27: mov ax, 0x3508 0x12b2a: pushf 0x12b2b: lcall ptr [0x5e2] 0x12b2f: mov word ptr [0x5ec], es 0x12b33: mov word ptr [0x5ea], bx 0x12b37: mov dx, 0x190 0x12b3a: mov ax, 0x2508 0x12b3d: pushf 0x12b3e: lcall ptr [0x5e2] 0x12b42: mov word ptr [0x272], 0 0x12b48: mov word ptr [0x273], 0 0x12b4e: mov ax, ds 0x12b50: mov es, ax 0x12b52: sub ax, 0x10
2018-12-25T12:42:41.519611039Z	75	PC: 12b6c \| Execute program
2018-12-25T12:42:41.532089863Z	53	PC: 13264 \| Get interrupt vector (Interrupt = '99' AKA 'Get DBCS lead byte table pointer')
2018-12-25T12:42:41.533636835Z	76	PC: 13244 \| Terminate with return code (Return code = '0')
2018-12-25T12:42:41.53629132Z	49	PC: 12b91 \| Terminate and stay resident (Return code = '92' \| Memory size = '122')

{"DateBased":true,"Day":1,"Month":12,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15118,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:42:41.526912861Z	53	PC: 12a64 \| Get interrupt vector (Interrupt = '99' AKA 'Get DBCS lead byte table pointer')
2018-12-25T12:42:41.528445762Z	53	PC: 12a73 \| Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:42:41.52996674Z	74	PC: 12b01 \| Reallocate memory
2018-12-25T12:42:41.531264738Z	37	PC: 12b09 \| Set interrupt vector (Interrupt = '99' AKA 'Get DBCS lead byte table pointer')
2018-12-25T12:42:41.533008041Z	37	PC: 12b11 \| Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:42:41.534016236Z	42	PC: 12b18 \| Get date 0x12b18: cmp dh, 0xc 0x12b1b: jne 0x12b4e 0x12b1d: cmp dl, 0x17 0x12b20: jbe 0x12b4e 0x12b22: cmp dl, 0x1b 0x12b25: jae 0x12b4e 0x12b27: mov ax, 0x3508 0x12b2a: pushf 0x12b2b: lcall ptr [0x5e2] 0x12b2f: mov word ptr [0x5ec], es 0x12b33: mov word ptr [0x5ea], bx 0x12b37: mov dx, 0x190 0x12b3a: mov ax, 0x2508 0x12b3d: pushf 0x12b3e: lcall ptr [0x5e2] 0x12b42: mov word ptr [0x272], 0 0x12b48: mov word ptr [0x273], 0 0x12b4e: mov ax, ds 0x12b50: mov es, ax 0x12b52: sub ax, 0x10
2018-12-25T12:42:41.536164205Z	75	PC: 12b6c \| Execute program
2018-12-25T12:42:41.551539412Z	53	PC: 13264 \| Get interrupt vector (Interrupt = '99' AKA 'Get DBCS lead byte table pointer')
2018-12-25T12:42:41.55325394Z	76	PC: 13244 \| Terminate with return code (Return code = '0')
2018-12-25T12:42:41.556723457Z	49	PC: 12b91 \| Terminate and stay resident (Return code = '92' \| Memory size = '122')