Sample viewer

vx.netlux.org/Virus.DOS.Fire.795

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:05:57.229081995Z 243 PC: 12a85 | UNKNOWN!
2018-12-17T23:05:57.2312175Z 42 PC: 12ad9 | Get date 0x12ad9: cmp cx, 0x7c9
0x12add: jb 0x12aeb
0x12adf: cmp dl, 3
0x12ae2: jne 0x12aeb
0x12ae4: cmp al, 4
0x12ae6: jne 0x12aeb
0x12ae8: jmp 0x12cb2
0x12aeb: xor ax, ax
0x12aed: mov ds, ax
0x12aef: mov ax, word ptr [0x84]
0x12af2: mov bx, word ptr [0x86]
0x12af6: mov word ptr es:[0x402], ax
0x12afa: mov word ptr es:[0x404], bx
0x12aff: cli
0x12b00: mov word ptr [0x84], 0x249
0x12b06: mov word ptr [0x86], es
0x12b0a: sti
0x12b0b: push cs
0x12b0c: pop es
0x12b0d: jmp 0x12a8c

{"DateBased":true,"Day":3,"Month":6,"Year":1993,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15367,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:15.767574958Z 243 PC: 12a85 | UNKNOWN!
2018-12-25T12:43:15.768623971Z 42 PC: 12ad9 | Get date 0x12ad9: cmp cx, 0x7c9
0x12add: jb 0x12aeb
0x12adf: cmp dl, 3
0x12ae2: jne 0x12aeb
0x12ae4: cmp al, 4
0x12ae6: jne 0x12aeb
0x12ae8: jmp 0x12cb2
0x12aeb: xor ax, ax
0x12aed: mov ds, ax
0x12aef: mov ax, word ptr [0x84]
0x12af2: mov bx, word ptr [0x86]
0x12af6: mov word ptr es:[0x402], ax
0x12afa: mov word ptr es:[0x404], bx
0x12aff: cli
0x12b00: mov word ptr [0x84], 0x249
0x12b06: mov word ptr [0x86], es
0x12b0a: sti
0x12b0b: push cs
0x12b0c: pop es
0x12b0d: jmp 0x12a8c
2018-12-25T12:43:15.776419739Z 53 PC: 12cff | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:43:15.778020944Z 37 PC: 12d10 | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:43:15.782043648Z 77 PC: 73177 | Get program return code

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15367,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:16.173495903Z 243 PC: 12a85 | UNKNOWN!
2018-12-25T12:43:16.174745325Z 42 PC: 12ad9 | Get date 0x12ad9: cmp cx, 0x7c9
0x12add: jb 0x12aeb
0x12adf: cmp dl, 3
0x12ae2: jne 0x12aeb
0x12ae4: cmp al, 4
0x12ae6: jne 0x12aeb
0x12ae8: jmp 0x12cb2
0x12aeb: xor ax, ax
0x12aed: mov ds, ax
0x12aef: mov ax, word ptr [0x84]
0x12af2: mov bx, word ptr [0x86]
0x12af6: mov word ptr es:[0x402], ax
0x12afa: mov word ptr es:[0x404], bx
0x12aff: cli
0x12b00: mov word ptr [0x84], 0x249
0x12b06: mov word ptr [0x86], es
0x12b0a: sti
0x12b0b: push cs
0x12b0c: pop es
0x12b0d: jmp 0x12a8c

{"DateBased":true,"Day":1,"Month":1,"Year":1993,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15367,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:16.176283397Z 243 PC: 12a85 | UNKNOWN!
2018-12-25T12:43:16.178723544Z 42 PC: 12ad9 | Get date 0x12ad9: cmp cx, 0x7c9
0x12add: jb 0x12aeb
0x12adf: cmp dl, 3
0x12ae2: jne 0x12aeb
0x12ae4: cmp al, 4
0x12ae6: jne 0x12aeb
0x12ae8: jmp 0x12cb2
0x12aeb: xor ax, ax
0x12aed: mov ds, ax
0x12aef: mov ax, word ptr [0x84]
0x12af2: mov bx, word ptr [0x86]
0x12af6: mov word ptr es:[0x402], ax
0x12afa: mov word ptr es:[0x404], bx
0x12aff: cli
0x12b00: mov word ptr [0x84], 0x249
0x12b06: mov word ptr [0x86], es
0x12b0a: sti
0x12b0b: push cs
0x12b0c: pop es
0x12b0d: jmp 0x12a8c

{"DateBased":true,"Day":3,"Month":1,"Year":1993,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15367,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:16.724088282Z 243 PC: 12a85 | UNKNOWN!
2018-12-25T12:43:16.725684833Z 42 PC: 12ad9 | Get date 0x12ad9: cmp cx, 0x7c9
0x12add: jb 0x12aeb
0x12adf: cmp dl, 3
0x12ae2: jne 0x12aeb
0x12ae4: cmp al, 4
0x12ae6: jne 0x12aeb
0x12ae8: jmp 0x12cb2
0x12aeb: xor ax, ax
0x12aed: mov ds, ax
0x12aef: mov ax, word ptr [0x84]
0x12af2: mov bx, word ptr [0x86]
0x12af6: mov word ptr es:[0x402], ax
0x12afa: mov word ptr es:[0x404], bx
0x12aff: cli
0x12b00: mov word ptr [0x84], 0x249
0x12b06: mov word ptr [0x86], es
0x12b0a: sti
0x12b0b: push cs
0x12b0c: pop es
0x12b0d: jmp 0x12a8c