Sample viewer

vx.netlux.org/Virus.DOS.Kemerovo.b

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:05:32.407186869Z 78 PC: 14156 | Find first file
2018-12-17T23:05:32.414189439Z 47 PC: 14164 | Get disk transfer address
2018-12-17T23:05:32.415283931Z 61 PC: 14180 | Open file (Filename = 'SLEEP.COM')
2018-12-17T23:05:32.421702346Z 63 PC: 141a0 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:05:32.428493849Z 66 PC: 141b4 | Move file pointer
2018-12-17T23:05:32.430127812Z 64 PC: 141c3 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T23:05:32.433075532Z 66 PC: 141cf | Move file pointer
2018-12-17T23:05:32.434448861Z 64 PC: 141dd | Write file or device (Write 256 bytes on handle 5)
2018-12-17T23:05:32.447636283Z 62 PC: 141f6 | Close file
2018-12-17T23:05:32.452659474Z 44 PC: 141fa | Get time 0x141fa: cmp dl, 0xa
0x141fd: jge 0x141e1
0x141ff: nop
0x14200: nop
0x14201: nop
0x14202: nop
0x14203: nop
0x14204: nop
0x14205: nop
0x14206: nop
0x14207: nop
0x14208: nop
0x14209: ljmp 0xffff:0
0x1420e: add byte ptr [bx + si], al
0x14210: add byte ptr [bx + si], al
0x14212: add byte ptr [bx + si], al
0x14214: add byte ptr [bx + si], al
0x14216: add byte ptr [bx + si], al
0x14218: add byte ptr [bx + si], al
0x1421a: add byte ptr [bx + si], al
2018-12-17T23:05:32.454273855Z 37 PC: 140e9 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:32.45581506Z 48 PC: 13db4 | Get DOS version
2018-12-17T23:05:32.456699724Z 9 PC: 13dc0 | Display string (String= ' Incorrect DOS version ')