Sample viewer

vx.netlux.org/Virus.DOS.HLLP.5062

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:05:57.711468569Z 53 PC: 1329a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:57.714005547Z 53 PC: 1329a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:05:57.716183399Z 53 PC: 1329a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:05:57.718233209Z 53 PC: 1329a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:57.720129241Z 53 PC: 1329a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:57.722419233Z 53 PC: 1329a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:57.724843225Z 53 PC: 1329a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:05:57.726755515Z 53 PC: 1329a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:05:57.729036962Z 53 PC: 1329a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:05:57.730853077Z 53 PC: 1329a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:05:57.732625936Z 53 PC: 1329a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:05:57.735466169Z 53 PC: 1329a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:05:57.737326067Z 53 PC: 1329a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:05:57.73877992Z 53 PC: 1329a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:05:57.74130471Z 53 PC: 1329a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:05:57.742997418Z 53 PC: 1329a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:05:57.745280227Z 53 PC: 1329a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:05:57.747529205Z 53 PC: 1329a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:57.748931579Z 53 PC: 1329a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:05:57.750389982Z 37 PC: 132af | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:57.752166813Z 37 PC: 132b7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:57.754415209Z 37 PC: 132bf | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:57.756025941Z 37 PC: 132c7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:57.75809727Z 68 PC: 13b99 | I/O control for devices (Set for = '')
2018-12-17T23:05:57.761365234Z 44 PC: 12ff3 | Get time 0x12ff3: mov byte ptr [0x58], dh
0x12ff7: cmp byte ptr [0x58], 0xf
0x12ffc: jae 0x13001
0x12ffe: jmp 0x130b3
0x13001: mov di, 0x4eb
0x13004: push cs
0x13005: push di
0x13006: mov di, 0x5b
0x13009: push ds
0x1300a: push di
0x1300b: mov ax, 0xff
0x1300e: push ax
0x1300f: lcall 0x1324:0x713
0x13014: mov di, 0x51a
0x13017: push cs
0x13018: push di
0x13019: mov di, 0x15b
0x1301c: push ds
0x1301d: push di
0x1301e: mov ax, 0xff
2018-12-17T23:05:57.764794981Z 64 PC: 130ac | Write file or device (Write 47 bytes on handle 1)
2018-12-17T23:05:57.77069071Z 64 PC: 130ac | Write file or device (Write 47 bytes on handle 1)
2018-12-17T23:05:57.779273345Z 64 PC: 130ac | Write file or device (Write 47 bytes on handle 1)
2018-12-17T23:05:57.787430747Z 64 PC: 130ac | Write file or device (Write 47 bytes on handle 1)
2018-12-17T23:05:57.794489708Z 64 PC: 130ac | Write file or device (Write 47 bytes on handle 1)
2018-12-17T23:05:57.801263322Z 48 PC: 138c4 | Get DOS version
2018-12-17T23:05:57.803007555Z 48 PC: 138c4 | Get DOS version
2018-12-17T23:05:57.804626972Z 61 PC: 13702 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:05:57.8129453Z 63 PC: 137d5 | Read file or device (Read 5056 bytes on handle 5)
2018-12-17T23:05:57.821721981Z 62 PC: 13752 | Close file
2018-12-17T23:05:57.824008792Z 26 PC: 13115 | Set disk transfer address
2018-12-17T23:05:57.826653145Z 78 PC: 13121 | Find first file
2018-12-17T23:05:57.834620808Z 61 PC: 13702 | Open file (Filename = 'TEST.EXE')
2018-12-17T23:05:57.843981087Z 66 PC: 13834 | Move file pointer
2018-12-17T23:05:57.848065497Z 63 PC: 137d5 | Read file or device (Read 6 bytes on handle 5)
2018-12-17T23:05:57.857557779Z 26 PC: 13139 | Set disk transfer address
2018-12-17T23:05:57.859264217Z 79 PC: 1313e | Find next file
2018-12-17T23:05:57.863427535Z 48 PC: 138c4 | Get DOS version
2018-12-17T23:05:57.866465504Z 26 PC: 13115 | Set disk transfer address
2018-12-17T23:05:57.868144227Z 78 PC: 13121 | Find first file
2018-12-17T23:05:57.875327367Z 48 PC: 138c4 | Get DOS version
2018-12-17T23:05:57.878124946Z 67 PC: 12baa | Get or set file attributes
2018-12-17T23:05:57.883561457Z 61 PC: 13702 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:05:57.891444785Z 66 PC: 13834 | Move file pointer
2018-12-17T23:05:57.895017253Z 63 PC: 137d5 | Read file or device (Read 5056 bytes on handle 6)
2018-12-17T23:05:57.904095077Z 66 PC: 13834 | Move file pointer
2018-12-17T23:05:57.90612978Z 64 PC: 13733 | Write file or device (Write 0 bytes on handle 6)
2018-12-17T23:05:57.922794737Z 66 PC: 13834 | Move file pointer
2018-12-17T23:05:57.924726798Z 64 PC: 137d5 | Write file or device (Write 5056 bytes on handle 6)
2018-12-17T23:05:57.933625347Z 62 PC: 13752 | Close file
2018-12-17T23:05:57.942201744Z 53 PC: 13216 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:57.944402737Z 37 PC: 1321f | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:57.945950816Z 53 PC: 13216 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:05:57.947873003Z 37 PC: 1321f | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:05:57.950404584Z 53 PC: 13216 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:05:57.951976735Z 37 PC: 1321f | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:05:57.953251053Z 53 PC: 13216 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:57.955397492Z 37 PC: 1321f | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:57.956846611Z 53 PC: 13216 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:57.958206339Z 37 PC: 1321f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:57.960485959Z 53 PC: 13216 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:57.962033267Z 37 PC: 1321f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:57.963420431Z 53 PC: 13216 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:05:57.965792279Z 37 PC: 1321f | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:05:57.967472702Z 53 PC: 13216 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:05:57.968960756Z 37 PC: 1321f | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:05:57.971155443Z 53 PC: 13216 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:05:57.972536181Z 37 PC: 1321f | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:05:57.973913847Z 53 PC: 13216 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:05:57.975980206Z 37 PC: 1321f | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:05:57.977373439Z 53 PC: 13216 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:05:57.978713751Z 37 PC: 1321f | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:05:57.979994555Z 53 PC: 13216 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:05:57.982198382Z 37 PC: 1321f | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:05:57.983475235Z 53 PC: 13216 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:05:57.984794084Z 37 PC: 1321f | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:05:57.987314607Z 53 PC: 13216 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:05:57.989028514Z 37 PC: 1321f | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:05:57.990668955Z 53 PC: 13216 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:05:57.993126906Z 37 PC: 1321f | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:05:57.994789577Z 53 PC: 13216 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:05:57.996459045Z 37 PC: 1321f | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:05:57.999044176Z 53 PC: 13216 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:05:58.00029592Z 37 PC: 1321f | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:05:58.001625281Z 53 PC: 13216 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:58.004364405Z 37 PC: 1321f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:58.005709644Z 53 PC: 13216 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:05:58.007511284Z 37 PC: 1321f | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:05:58.009940264Z 41 PC: 131cd | Parse filename
2018-12-17T23:05:58.01195678Z 41 PC: 131db | Parse filename
2018-12-17T23:05:58.013908101Z 75 PC: 131e6 | Execute program
2018-12-17T23:05:58.031506313Z 9 PC: 17988 | Display string (Could not find end pointer)
2018-12-17T23:05:58.047352513Z 76 PC: 1798c | Terminate with return code (Return code = '36')
2018-12-17T23:05:58.051889428Z 53 PC: 13216 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:58.053147309Z 37 PC: 1321f | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:58.055017362Z 53 PC: 13216 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:05:58.056309633Z 37 PC: 1321f | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:05:58.057447423Z 53 PC: 13216 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:05:58.059802262Z 37 PC: 1321f | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:05:58.061106771Z 53 PC: 13216 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:58.062646356Z 37 PC: 1321f | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:58.064635157Z 53 PC: 13216 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:58.066017371Z 37 PC: 1321f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:58.067135094Z 53 PC: 13216 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:58.069161842Z 37 PC: 1321f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:58.070718669Z 53 PC: 13216 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:05:58.072205153Z 37 PC: 1321f | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:05:58.073919076Z 53 PC: 13216 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:05:58.075842317Z 37 PC: 1321f | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:05:58.077352329Z 53 PC: 13216 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:05:58.079417697Z 37 PC: 1321f | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:05:58.080472776Z 53 PC: 13216 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:05:58.081835973Z 37 PC: 1321f | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:05:58.083402317Z 53 PC: 13216 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:05:58.085472331Z 37 PC: 1321f | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:05:58.086498963Z 53 PC: 13216 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:05:58.087512452Z 37 PC: 1321f | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:05:58.088723563Z 53 PC: 13216 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:05:58.089616611Z 37 PC: 1321f | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:05:58.090789946Z 53 PC: 13216 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:05:58.09261098Z 37 PC: 1321f | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:05:58.093681511Z 53 PC: 13216 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:05:58.094819966Z 37 PC: 1321f | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:05:58.096601587Z 53 PC: 13216 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:05:58.097606077Z 37 PC: 1321f | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:05:58.09866606Z 53 PC: 13216 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:05:58.100267659Z 37 PC: 1321f | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:05:58.101257115Z 53 PC: 13216 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:58.102754742Z 37 PC: 1321f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:58.104154844Z 53 PC: 13216 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:05:58.105170285Z 37 PC: 1321f | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:05:58.106202471Z 48 PC: 138c4 | Get DOS version
2018-12-17T23:05:58.1079282Z 61 PC: 13702 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:05:58.112473456Z 64 PC: 137d5 | Write file or device (Write 5056 bytes on handle 6)
2018-12-17T23:05:58.121576135Z 66 PC: 13834 | Move file pointer
2018-12-17T23:05:58.123278129Z 64 PC: 137d5 | Write file or device (Write 5056 bytes on handle 6)
2018-12-17T23:05:58.132801006Z 66 PC: 13834 | Move file pointer
2018-12-17T23:05:58.135445074Z 64 PC: 137d5 | Write file or device (Write 6 bytes on handle 6)
2018-12-17T23:05:58.139382135Z 62 PC: 13752 | Close file
2018-12-17T23:05:58.14878079Z 42 PC: 130d0 | Get date 0x130d0: mov byte ptr [0x59], dl
0x130d4: cmp byte ptr [0x59], 0x17
0x130d9: jb 0x130e5
0x130db: mov di, 0x561
0x130de: push ds
0x130df: push di
0x130e0: lcall 0x1324:0x5fd
0x130e5: pop bp
0x130e6: xor ax, ax
0x130e8: lcall 0x1324:0x116
0x130ed: add byte ptr [bx + si], al
0x130ef: add byte ptr [di - 0x75], dl
0x130f2: in al, dx
0x130f3: sub sp, 0x50
0x130f6: push ds
0x130f7: lds si, ptr [bp + 0xc]
0x130fa: lea di, word ptr [bp - 0x50]
0x130fd: push ss
0x130fe: pop es
0x130ff: cld
2018-12-17T23:05:58.151478246Z 64 PC: 1365d | Write file or device (Write 0 bytes on handle 1)
2018-12-17T23:05:58.153512614Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:58.155281192Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:05:58.156680754Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:05:58.158075027Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:58.160017918Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:58.161339002Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:58.162755726Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:05:58.164547339Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:05:58.165912073Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:05:58.167077357Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:05:58.169271924Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:05:58.170801179Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:05:58.172295121Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:05:58.174512456Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:05:58.176042034Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:05:58.177637203Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:05:58.180382934Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:05:58.182006306Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:58.183482973Z 37 PC: 133f1 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:05:58.186092706Z 76 PC: 13430 | Terminate with return code (Return code = '0')