Sample viewer

vx.netlux.org/Virus.DOS.Zhengxi.7313.a

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:05:09.702208217Z 77 PC: 15429 | Get program return code
2018-12-17T23:05:10.203069968Z 58 PC: 157c7 | Remove subdirectory
2018-12-17T23:05:10.206008172Z 98 PC: 14ea6 | Get current PSP
2018-12-17T23:05:10.207265034Z 81 PC: 14eef | Get current PSP
2018-12-17T23:05:10.288234735Z 37 PC: 13174 | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T23:05:10.292321956Z 51 PC: 136e2 | Get or set Ctrl-Break
2018-12-17T23:05:10.293768557Z 47 PC: 13700 | Get disk transfer address
2018-12-17T23:05:10.29547071Z 26 PC: 1370b | Set disk transfer address
2018-12-17T23:05:10.298055066Z 81 PC: 14195 | Get current PSP
2018-12-17T23:05:10.299402227Z 78 PC: 13712 | Find first file
2018-12-17T23:05:10.306621743Z 26 PC: 13718 | Set disk transfer address
2018-12-17T23:05:10.308585738Z 42 PC: 1371c | Get date 0x1371c: xor dx, word ptr [bp + 0x3d]
0x1371f: and dx, 0x18
0x13722: je 0x136fa
0x13724: mov ah, 0x51
0x13726: int 0x21
0x13728: mov es, bx
0x1372a: dec bx
0x1372b: mov ds, bx
0x1372d: mov bx, word ptr [3]
0x13731: sub bh, 7
0x13734: mov ah, 0x4a
0x13736: int 0x21
0x13738: mov ah, 0x48
0x1373a: mov bx, 0x6ff
0x1373d: int 0x21
0x1373f: jb 0x136fa
0x13741: cmp word ptr es:[0], 0x20cd
0x13748: jne 0x13750
0x1374a: sub byte ptr es:[3], 8
0x13750: dec ax
2018-12-17T23:05:10.559855737Z 9 PC: 12a82 | Display string (String= 'Zhengxi.7313, Copyright (c) 1995 Zhengxi Ltd ')
2018-12-17T23:05:10.563126246Z 76 PC: 12a86 | Terminate with return code (Return code = '36')