Sample viewer

vx.netlux.org/Virus.DOS.Vienna.648.k

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:05:20.437363883Z 48 PC: 12ba6 | Get DOS version
2018-12-17T23:05:20.439366929Z 47 PC: 12bb2 | Get disk transfer address
2018-12-17T23:05:20.441706397Z 26 PC: 12bc5 | Set disk transfer address
2018-12-17T23:05:20.44325549Z 78 PC: 12c51 | Find first file
2018-12-17T23:05:20.450063693Z 67 PC: 12c8f | Get or set file attributes
2018-12-17T23:05:20.456843219Z 67 PC: 12ca2 | Get or set file attributes
2018-12-17T23:05:20.474598752Z 61 PC: 12cad | Open file (Filename = 'SLEEP.COM')
2018-12-17T23:05:20.481844032Z 87 PC: 12cb9 | Get or set file date and time
2018-12-17T23:05:20.484286685Z 44 PC: 12cc5 | Get time 0x12cc5: and dh, 7
0x12cc8: jne 0x12cda
0x12cca: mov ah, 0x40
0x12ccc: mov cx, 5
0x12ccf: mov dx, si
0x12cd1: add dx, 0x8a
0x12cd5: int 0x21
0x12cd7: jmp 0x12d3e
0x12cd9: nop
0x12cda: mov ah, 0x3f
0x12cdc: mov cx, 3
0x12cdf: mov dx, 0xa
0x12ce2: nop
0x12ce3: add dx, si
0x12ce5: int 0x21
0x12ce7: jb 0x12d3e
0x12ce9: cmp ax, 3
0x12cec: jne 0x12d3e
0x12cee: mov ax, 0x4202
0x12cf1: mov cx, 0
2018-12-17T23:05:20.48719978Z 63 PC: 12ce7 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T23:05:20.494785601Z 66 PC: 12cf9 | Move file pointer
2018-12-17T23:05:20.497446115Z 64 PC: 12d1d | Write file or device (Write 648 bytes on handle 5)
2018-12-17T23:05:20.508545248Z 66 PC: 12d2f | Move file pointer
2018-12-17T23:05:20.510003011Z 64 PC: 12d3e | Write file or device (Write 3 bytes on handle 5)
2018-12-17T23:05:20.517463362Z 87 PC: 12d53 | Get or set file date and time
2018-12-17T23:05:20.520908463Z 62 PC: 12d57 | Close file
2018-12-17T23:05:20.529914236Z 67 PC: 12d66 | Get or set file attributes
2018-12-17T23:05:20.541626468Z 26 PC: 12d73 | Set disk transfer address
2018-12-17T23:05:20.543149419Z 9 PC: 12a82 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-17T23:05:20.547971434Z 76 PC: 12a86 | Terminate with return code (Return code = '36')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":15163,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:42:46.161134916Z 48 PC: 12ba6 | Get DOS version
2018-12-25T12:42:46.162752975Z 47 PC: 12bb2 | Get disk transfer address
2018-12-25T12:42:46.163569359Z 26 PC: 12bc5 | Set disk transfer address
2018-12-25T12:42:46.164538673Z 78 PC: 12c51 | Find first file
2018-12-25T12:42:46.169009666Z 67 PC: 12c8f | Get or set file attributes
2018-12-25T12:42:46.172704621Z 67 PC: 12ca2 | Get or set file attributes
2018-12-25T12:42:46.863834026Z 61 PC: 12cad | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:42:47.019803955Z 87 PC: 12cb9 | Get or set file date and time
2018-12-25T12:42:47.021668351Z 44 PC: 12cc5 | Get time 0x12cc5: and dh, 7
0x12cc8: jne 0x12cda
0x12cca: mov ah, 0x40
0x12ccc: mov cx, 5
0x12ccf: mov dx, si
0x12cd1: add dx, 0x8a
0x12cd5: int 0x21
0x12cd7: jmp 0x12d3e
0x12cd9: nop
0x12cda: mov ah, 0x3f
0x12cdc: mov cx, 3
0x12cdf: mov dx, 0xa
0x12ce2: nop
0x12ce3: add dx, si
0x12ce5: int 0x21
0x12ce7: jb 0x12d3e
0x12ce9: cmp ax, 3
0x12cec: jne 0x12d3e
0x12cee: mov ax, 0x4202
0x12cf1: mov cx, 0
2018-12-25T12:42:47.024106248Z 63 PC: 12ce7 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:42:47.031551898Z 66 PC: 12cf9 | Move file pointer
2018-12-25T12:42:47.034105699Z 64 PC: 12d1d | Write file or device (Write 648 bytes on handle 5)
2018-12-25T12:42:47.148903408Z 66 PC: 12d2f | Move file pointer
2018-12-25T12:42:47.150145131Z 64 PC: 12d3e | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:42:47.158094717Z 87 PC: 12d53 | Get or set file date and time
2018-12-25T12:42:47.159612222Z 62 PC: 12d57 | Close file
2018-12-25T12:42:47.371123166Z 67 PC: 12d66 | Get or set file attributes
2018-12-25T12:42:47.578059898Z 26 PC: 12d73 | Set disk transfer address
2018-12-25T12:42:47.579116475Z 9 PC: 12a82 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-25T12:42:47.584271483Z 76 PC: 12a86 | Terminate with return code (Return code = '36')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":7,"TimeBased":true,"OriginalID":15163,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:42:46.444707278Z 48 PC: 12ba6 | Get DOS version
2018-12-25T12:42:46.446157912Z 47 PC: 12bb2 | Get disk transfer address
2018-12-25T12:42:46.44767403Z 26 PC: 12bc5 | Set disk transfer address
2018-12-25T12:42:46.448767113Z 78 PC: 12c51 | Find first file
2018-12-25T12:42:46.45475691Z 67 PC: 12c8f | Get or set file attributes
2018-12-25T12:42:46.460119057Z 67 PC: 12ca2 | Get or set file attributes
2018-12-25T12:42:47.488335214Z 61 PC: 12cad | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:42:47.495587334Z 87 PC: 12cb9 | Get or set file date and time
2018-12-25T12:42:47.498247782Z 44 PC: 12cc5 | Get time 0x12cc5: and dh, 7
0x12cc8: jne 0x12cda
0x12cca: mov ah, 0x40
0x12ccc: mov cx, 5
0x12ccf: mov dx, si
0x12cd1: add dx, 0x8a
0x12cd5: int 0x21
0x12cd7: jmp 0x12d3e
0x12cd9: nop
0x12cda: mov ah, 0x3f
0x12cdc: mov cx, 3
0x12cdf: mov dx, 0xa
0x12ce2: nop
0x12ce3: add dx, si
0x12ce5: int 0x21
0x12ce7: jb 0x12d3e
0x12ce9: cmp ax, 3
0x12cec: jne 0x12d3e
0x12cee: mov ax, 0x4202
0x12cf1: mov cx, 0
2018-12-25T12:42:47.500480153Z 63 PC: 12ce7 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:42:47.571380775Z 66 PC: 12cf9 | Move file pointer
2018-12-25T12:42:47.572872012Z 64 PC: 12d1d | Write file or device (Write 648 bytes on handle 5)
2018-12-25T12:42:47.723104148Z 66 PC: 12d2f | Move file pointer
2018-12-25T12:42:47.724575209Z 64 PC: 12d3e | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:42:47.7293452Z 87 PC: 12d53 | Get or set file date and time
2018-12-25T12:42:47.730533422Z 62 PC: 12d57 | Close file
2018-12-25T12:42:47.908473045Z 67 PC: 12d66 | Get or set file attributes
2018-12-25T12:42:47.956407771Z 26 PC: 12d73 | Set disk transfer address
2018-12-25T12:42:47.957587208Z 9 PC: 12a82 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-25T12:42:47.964465829Z 76 PC: 12a86 | Terminate with return code (Return code = '36')