Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Brian.4885

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:05:58.226029004Z 53 PC: 1326a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:58.227964821Z 53 PC: 1326a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:05:58.230248125Z 53 PC: 1326a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:05:58.231843894Z 53 PC: 1326a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:58.233480448Z 53 PC: 1326a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:58.235478835Z 53 PC: 1326a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:58.23778469Z 53 PC: 1326a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:05:58.239215919Z 53 PC: 1326a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:05:58.242071933Z 53 PC: 1326a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:05:58.243289545Z 53 PC: 1326a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:05:58.244504369Z 53 PC: 1326a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:05:58.246179974Z 53 PC: 1326a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:05:58.247525217Z 53 PC: 1326a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:05:58.248744871Z 53 PC: 1326a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:05:58.250100032Z 53 PC: 1326a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:05:58.251448063Z 53 PC: 1326a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:05:58.2526113Z 53 PC: 1326a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:05:58.253723464Z 53 PC: 1326a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:58.255243755Z 53 PC: 1326a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:05:58.2564718Z 37 PC: 1327f | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:58.257619339Z 37 PC: 13287 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:58.259236708Z 37 PC: 1328f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:58.260697395Z 37 PC: 13297 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:58.262507835Z 68 PC: 13af5 | I/O control for devices (Set for = '')
2018-12-17T23:05:58.264555091Z 42 PC: 12fa0 | Get date 0x12fa0: mov byte ptr [0x56], dh
0x12fa4: mov byte ptr [0x57], dl
0x12fa8: mov ah, 0x2c
0x12faa: int 0x21
0x12fac: mov byte ptr [0x58], ch
0x12fb0: mov byte ptr [0x59], dh
0x12fb4: cmp byte ptr [0x57], 8
0x12fb9: mov al, 0
0x12fbb: jne 0x12fbe
0x12fbd: inc ax
0x12fbe: mov dl, al
0x12fc0: cmp byte ptr [0x56], 1
0x12fc5: mov al, 0
0x12fc7: jne 0x12fca
0x12fc9: inc ax
0x12fca: and al, dl
0x12fcc: or al, al
0x12fce: je 0x12ff2
0x12fd0: mov di, 0x501
0x12fd3: push cs
2018-12-17T23:05:58.267258175Z 44 PC: 12fac | Get time 0x12fac: mov byte ptr [0x58], ch
0x12fb0: mov byte ptr [0x59], dh
0x12fb4: cmp byte ptr [0x57], 8
0x12fb9: mov al, 0
0x12fbb: jne 0x12fbe
0x12fbd: inc ax
0x12fbe: mov dl, al
0x12fc0: cmp byte ptr [0x56], 1
0x12fc5: mov al, 0
0x12fc7: jne 0x12fca
0x12fc9: inc ax
0x12fca: and al, dl
0x12fcc: or al, al
0x12fce: je 0x12ff2
0x12fd0: mov di, 0x501
0x12fd3: push cs
0x12fd4: push di
0x12fd5: mov di, 0x5b
0x12fd8: push ds
0x12fd9: push di
2018-12-17T23:05:58.270232247Z 64 PC: 12f3d | Write file or device (Write 12 bytes on handle 1)
2018-12-17T23:05:58.274499735Z 48 PC: 13820 | Get DOS version
2018-12-17T23:05:58.276241736Z 48 PC: 13820 | Get DOS version
2018-12-17T23:05:58.277992615Z 61 PC: 136d2 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:05:58.286551478Z 63 PC: 137a5 | Read file or device (Read 4880 bytes on handle 5)
2018-12-17T23:05:58.294774796Z 62 PC: 13722 | Close file
2018-12-17T23:05:58.296983491Z 26 PC: 130e7 | Set disk transfer address
2018-12-17T23:05:58.299428175Z 78 PC: 130f3 | Find first file
2018-12-17T23:05:58.308298797Z 26 PC: 1310b | Set disk transfer address
2018-12-17T23:05:58.317089817Z 79 PC: 13110 | Find next file
2018-12-17T23:05:58.320859926Z 48 PC: 13820 | Get DOS version
2018-12-17T23:05:58.323418555Z 26 PC: 130e7 | Set disk transfer address
2018-12-17T23:05:58.324882129Z 78 PC: 130f3 | Find first file
2018-12-17T23:05:58.331428331Z 48 PC: 13820 | Get DOS version
2018-12-17T23:05:58.334016958Z 67 PC: 130b6 | Get or set file attributes
2018-12-17T23:05:58.350984038Z 61 PC: 136d2 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:05:58.358865682Z 66 PC: 13804 | Move file pointer
2018-12-17T23:05:58.363217308Z 63 PC: 137a5 | Read file or device (Read 4880 bytes on handle 5)
2018-12-17T23:05:58.365261004Z 66 PC: 13804 | Move file pointer
2018-12-17T23:05:58.366911874Z 64 PC: 13703 | Write file or device (Write 0 bytes on handle 5)
2018-12-17T23:05:58.369551926Z 66 PC: 13804 | Move file pointer
2018-12-17T23:05:58.371315218Z 64 PC: 137a5 | Write file or device (Write 4880 bytes on handle 5)
2018-12-17T23:05:58.381019988Z 62 PC: 13722 | Close file
2018-12-17T23:05:58.391559382Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:58.393117125Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:58.394539251Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:05:58.402773475Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:05:58.405739186Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:05:58.407027784Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:05:58.408205314Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:58.410868889Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:58.412514214Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:58.41392927Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:58.416796391Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:58.418507705Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:58.420240381Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:05:58.422907333Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:05:58.424448438Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:05:58.426664852Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:05:58.429471682Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:05:58.43192153Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:05:58.433579747Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:05:58.435566077Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:05:58.437247411Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:05:58.439120438Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:05:58.44098882Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:05:58.443739722Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:05:58.445144357Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:05:58.446678236Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:05:58.448812346Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:05:58.450227368Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:05:58.451666501Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:05:58.454086145Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:05:58.455736732Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:05:58.457380387Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:05:58.459692331Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:05:58.461239249Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:05:58.462836892Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:58.465085564Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:58.466619613Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:05:58.468014333Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:05:58.470069853Z 41 PC: 1319f | Parse filename
2018-12-17T23:05:58.471896451Z 41 PC: 131ad | Parse filename
2018-12-17T23:05:58.474477904Z 75 PC: 131b8 | Execute program
2018-12-17T23:05:58.503726304Z 0 PC: 185ce | Program terminate
2018-12-17T23:05:58.507270552Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:58.509005709Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:58.511400627Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:05:58.512867954Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:05:58.514181576Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:05:58.515702846Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:05:58.517739759Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:58.519058621Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:58.520328156Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:58.52327075Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:58.524875424Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:58.526505858Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:58.529076099Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:05:58.530724837Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:05:58.532314148Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:05:58.534656336Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:05:58.535979108Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:05:58.537421653Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:05:58.542086049Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:05:58.544036212Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:05:58.54544122Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:05:58.547449406Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:05:58.549615194Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:05:58.550910948Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:05:58.552630027Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:05:58.554087208Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:05:58.555593862Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:05:58.557129298Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:05:58.559172289Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:05:58.560456846Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:05:58.562824825Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:05:58.565367888Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:05:58.566969376Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:05:58.568588072Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:05:58.571005883Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:58.572539731Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:58.574034103Z 53 PC: 131e8 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:05:58.57625867Z 37 PC: 131f1 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:05:58.578042192Z 48 PC: 13820 | Get DOS version
2018-12-17T23:05:58.580208539Z 67 PC: 130b6 | Get or set file attributes
2018-12-17T23:05:58.592957035Z 61 PC: 136d2 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:05:58.601151632Z 64 PC: 137a5 | Write file or device (Write 4880 bytes on handle 5)
2018-12-17T23:05:58.610682322Z 66 PC: 13804 | Move file pointer
2018-12-17T23:05:58.613623265Z 64 PC: 137a5 | Write file or device (Write 4880 bytes on handle 5)
2018-12-17T23:05:58.615943071Z 66 PC: 13804 | Move file pointer
2018-12-17T23:05:58.618794694Z 64 PC: 137a5 | Write file or device (Write 5 bytes on handle 5)
2018-12-17T23:05:58.627895715Z 62 PC: 13722 | Close file
2018-12-17T23:05:58.637436439Z 64 PC: 1362d | Write file or device (Write 0 bytes on handle 1)
2018-12-17T23:05:58.640190765Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:05:58.642761279Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:05:58.644127385Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:05:58.645461026Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:05:58.647292824Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:05:58.648598466Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:58.649821471Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:05:58.651559514Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:05:58.652584677Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:05:58.653880255Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:05:58.655410989Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:05:58.656417029Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:05:58.657401829Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:05:58.659280329Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:05:58.660891848Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:05:58.662468757Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:05:58.664602337Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:05:58.666057956Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:05:58.667435671Z 37 PC: 133c1 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:05:58.669366521Z 76 PC: 13400 | Terminate with return code (Return code = '0')