Sample viewer

vx.netlux.org/Virus.DOS.Eupm.1731.d

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:06:01.827870886Z 255 PC: 131b9 | UNKNOWN!
2018-12-17T23:06:01.829037362Z 42 PC: 13245 | Get date 0x13245: cmp cx, 0x7c8
0x13249: jge 0x1324e
0x1324b: jmp 0x13256
0x1324d: nop
0x1324e: cmp dl, 1
0x13251: jne 0x13256
0x13253: call 0x13398
0x13256: xor ax, ax
0x13258: mov es, ax
0x1325a: mov ax, word ptr es:[0x3fc]
0x1325e: mov word ptr cs:[0x53], ax
0x13262: mov ax, word ptr es:[0x3fe]
0x13266: mov word ptr cs:[0x55], ax
0x1326a: mov word ptr es:[0x3fc], 0xa4f3
0x13271: mov word ptr es:[0x3fe], 0xcb
0x13278: mov ax, word ptr cs:[1]
0x1327c: add ax, 0x10
0x1327f: mov es, ax
0x13281: xor di, di
0x13283: mov si, 0
2018-12-17T23:06:01.843117377Z 74 PC: 12ed4 | Reallocate memory
2018-12-17T23:06:01.847050372Z 53 PC: 12ed9 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:06:01.848623369Z 37 PC: 12eeb | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:06:01.85112855Z 75 PC: 12f23 | Execute program
2018-12-17T23:06:01.868077735Z 76 PC: 13278 | Terminate with return code (Return code = '76')
2018-12-17T23:06:01.871605837Z 77 PC: 12f31 | Get program return code
2018-12-17T23:06:01.873889544Z 72 PC: 12f3f | Allocate memory
2018-12-17T23:06:01.875932688Z 72 PC: 12f56 | Allocate memory
2018-12-17T23:06:01.877632529Z 72 PC: 12f62 | Allocate memory
2018-12-17T23:06:01.880401235Z 37 PC: 12fa0 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:06:01.881617027Z 76 PC: 12fa8 | Terminate with return code (Return code = '76')

{"DateBased":true,"Day":2,"Month":1,"Year":1992,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15395,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:18.04960326Z 255 PC: 131b9 | UNKNOWN!
2018-12-25T12:43:18.05072594Z 42 PC: 13245 | Get date 0x13245: cmp cx, 0x7c8
0x13249: jge 0x1324e
0x1324b: jmp 0x13256
0x1324d: nop
0x1324e: cmp dl, 1
0x13251: jne 0x13256
0x13253: call 0x13398
0x13256: xor ax, ax
0x13258: mov es, ax
0x1325a: mov ax, word ptr es:[0x3fc]
0x1325e: mov word ptr cs:[0x53], ax
0x13262: mov ax, word ptr es:[0x3fe]
0x13266: mov word ptr cs:[0x55], ax
0x1326a: mov word ptr es:[0x3fc], 0xa4f3
0x13271: mov word ptr es:[0x3fe], 0xcb
0x13278: mov ax, word ptr cs:[1]
0x1327c: add ax, 0x10
0x1327f: mov es, ax
0x13281: xor di, di
0x13283: mov si, 0
2018-12-25T12:43:18.052905194Z 74 PC: 12ed4 | Reallocate memory
2018-12-25T12:43:18.054052618Z 53 PC: 12ed9 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:43:18.055404067Z 37 PC: 12eeb | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:43:18.056515493Z 75 PC: 12f23 | Execute program
2018-12-25T12:43:18.070971465Z 76 PC: 13278 | Terminate with return code (Return code = '76')
2018-12-25T12:43:18.074531571Z 77 PC: 12f31 | Get program return code
2018-12-25T12:43:18.075594248Z 72 PC: 12f3f | Allocate memory
2018-12-25T12:43:18.07707683Z 72 PC: 12f56 | Allocate memory
2018-12-25T12:43:18.07861603Z 72 PC: 12f62 | Allocate memory
2018-12-25T12:43:18.080426258Z 37 PC: 12fa0 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:43:18.081421049Z 76 PC: 12fa8 | Terminate with return code (Return code = '76')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15395,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:18.159344409Z 255 PC: 131b9 | UNKNOWN!
2018-12-25T12:43:18.161072511Z 42 PC: 13245 | Get date 0x13245: cmp cx, 0x7c8
0x13249: jge 0x1324e
0x1324b: jmp 0x13256
0x1324d: nop
0x1324e: cmp dl, 1
0x13251: jne 0x13256
0x13253: call 0x13398
0x13256: xor ax, ax
0x13258: mov es, ax
0x1325a: mov ax, word ptr es:[0x3fc]
0x1325e: mov word ptr cs:[0x53], ax
0x13262: mov ax, word ptr es:[0x3fe]
0x13266: mov word ptr cs:[0x55], ax
0x1326a: mov word ptr es:[0x3fc], 0xa4f3
0x13271: mov word ptr es:[0x3fe], 0xcb
0x13278: mov ax, word ptr cs:[1]
0x1327c: add ax, 0x10
0x1327f: mov es, ax
0x13281: xor di, di
0x13283: mov si, 0
2018-12-25T12:43:18.164584472Z 74 PC: 12ed4 | Reallocate memory
2018-12-25T12:43:18.166029804Z 53 PC: 12ed9 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:43:18.167669466Z 37 PC: 12eeb | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:43:18.169779293Z 75 PC: 12f23 | Execute program
2018-12-25T12:43:18.186838469Z 76 PC: 13278 | Terminate with return code (Return code = '76')
2018-12-25T12:43:18.190292159Z 77 PC: 12f31 | Get program return code
2018-12-25T12:43:18.204566956Z 72 PC: 12f3f | Allocate memory
2018-12-25T12:43:18.206860617Z 72 PC: 12f56 | Allocate memory
2018-12-25T12:43:18.208764191Z 72 PC: 12f62 | Allocate memory
2018-12-25T12:43:18.214280646Z 37 PC: 12fa0 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:43:18.216986323Z 76 PC: 12fa8 | Terminate with return code (Return code = '76')

{"DateBased":true,"Day":1,"Month":1,"Year":1992,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15395,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:18.253256407Z 255 PC: 131b9 | UNKNOWN!
2018-12-25T12:43:18.254358702Z 42 PC: 13245 | Get date 0x13245: cmp cx, 0x7c8
0x13249: jge 0x1324e
0x1324b: jmp 0x13256
0x1324d: nop
0x1324e: cmp dl, 1
0x13251: jne 0x13256
0x13253: call 0x13398
0x13256: xor ax, ax
0x13258: mov es, ax
0x1325a: mov ax, word ptr es:[0x3fc]
0x1325e: mov word ptr cs:[0x53], ax
0x13262: mov ax, word ptr es:[0x3fe]
0x13266: mov word ptr cs:[0x55], ax
0x1326a: mov word ptr es:[0x3fc], 0xa4f3
0x13271: mov word ptr es:[0x3fe], 0xcb
0x13278: mov ax, word ptr cs:[1]
0x1327c: add ax, 0x10
0x1327f: mov es, ax
0x13281: xor di, di
0x13283: mov si, 0
2018-12-25T12:43:18.664313042Z 74 PC: 12ed4 | Reallocate memory
2018-12-25T12:43:18.66613247Z 53 PC: 12ed9 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:43:18.668735948Z 37 PC: 12eeb | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:43:18.67010363Z 75 PC: 12f23 | Execute program
2018-12-25T12:43:18.681587885Z 76 PC: 13278 | Terminate with return code (Return code = '76')
2018-12-25T12:43:18.683941436Z 77 PC: 12f31 | Get program return code
2018-12-25T12:43:18.685540729Z 72 PC: 12f3f | Allocate memory
2018-12-25T12:43:18.686956169Z 72 PC: 12f56 | Allocate memory
2018-12-25T12:43:18.688137433Z 72 PC: 12f62 | Allocate memory
2018-12-25T12:43:18.690624172Z 37 PC: 12fa0 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:43:18.692067067Z 76 PC: 12fa8 | Terminate with return code (Return code = '76')