Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Rsw.5846.a

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:06:20.720120253Z 53 PC: 13832 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:06:20.722133842Z 53 PC: 13832 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:06:20.723621212Z 53 PC: 13832 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:06:20.725070513Z 53 PC: 13832 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:06:20.728287538Z 53 PC: 13832 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:06:20.729630295Z 53 PC: 13832 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:06:20.731021338Z 53 PC: 13832 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:06:20.73251918Z 53 PC: 13832 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:06:20.734046002Z 53 PC: 13832 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:06:20.735176309Z 53 PC: 13832 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:06:20.736282051Z 53 PC: 13832 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:06:20.737523198Z 53 PC: 13832 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:06:20.738632593Z 53 PC: 13832 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:06:20.739744505Z 53 PC: 13832 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:06:20.744017979Z 53 PC: 13832 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:06:20.745044406Z 53 PC: 13832 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:06:20.745968727Z 53 PC: 13832 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:06:20.752642638Z 53 PC: 13832 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:06:20.754634091Z 53 PC: 13832 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:06:20.756576416Z 37 PC: 13847 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:06:20.759050644Z 37 PC: 1384f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:06:20.760263091Z 37 PC: 13857 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:06:20.761410312Z 37 PC: 1385f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:06:20.763403688Z 68 PC: 13e32 | I/O control for devices (Set for = '')
2018-12-17T23:06:20.765713789Z 42 PC: 134b7 | Get date 0x134b7: xor ah, ah
0x134b9: les di, ptr [bp + 6]
0x134bc: stosw word ptr es:[di], ax
0x134bd: mov al, dl
0x134bf: les di, ptr [bp + 0xa]
0x134c2: stosw word ptr es:[di], ax
0x134c3: mov al, dh
0x134c5: les di, ptr [bp + 0xe]
0x134c8: stosw word ptr es:[di], ax
0x134c9: xchg ax, cx
0x134ca: les di, ptr [bp + 0x12]
0x134cd: stosw word ptr es:[di], ax
0x134ce: pop bp
0x134cf: retf 0x10
0x134d2: push bp
0x134d3: mov bp, sp
0x134d5: mov cx, word ptr [bp + 0xa]
0x134d8: mov dh, byte ptr [bp + 8]
0x134db: mov dl, byte ptr [bp + 6]
0x134de: mov ah, 0x2b
2018-12-17T23:06:20.76891135Z 64 PC: 13f35 | Write file or device (Write 2 bytes on handle 1)
2018-12-17T23:06:20.774351319Z 64 PC: 13f35 | Write file or device (Write 36 bytes on handle 1)
2018-12-17T23:06:20.779726718Z 64 PC: 13f35 | Write file or device (Write 53 bytes on handle 1)
2018-12-17T23:06:20.78708285Z 64 PC: 13f35 | Write file or device (Write 28 bytes on handle 1)
2018-12-17T23:06:20.79357109Z 64 PC: 13f35 | Write file or device (Write 39 bytes on handle 1)
2018-12-17T23:06:20.80010684Z 64 PC: 13f35 | Write file or device (Write 0 bytes on handle 1)
2018-12-17T23:06:20.802198542Z 37 PC: 13946 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:06:20.804724784Z 37 PC: 13946 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:06:20.806291304Z 37 PC: 13946 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:06:20.807716835Z 37 PC: 13946 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:06:20.809355006Z 37 PC: 13946 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:06:20.813373362Z 37 PC: 13946 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:06:20.815308186Z 37 PC: 13946 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:06:20.816538788Z 37 PC: 13946 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:06:20.819467788Z 37 PC: 13946 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:06:20.820568039Z 37 PC: 13946 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:06:20.821639235Z 37 PC: 13946 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:06:20.823648172Z 37 PC: 13946 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:06:20.825885887Z 37 PC: 13946 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:06:20.827935907Z 37 PC: 13946 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:06:20.830260164Z 37 PC: 13946 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:06:20.831717766Z 37 PC: 13946 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:06:20.833169537Z 37 PC: 13946 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:06:20.835201732Z 37 PC: 13946 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:06:20.836631474Z 37 PC: 13946 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:06:20.838707706Z 76 PC: 13985 | Terminate with return code (Return code = '0')