Sample viewer

vx.netlux.org/Virus.DOS.AngryBoy.2132

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:06:50.525190713Z 175 PC: 14838 | UNKNOWN!
2018-12-17T23:06:50.526432627Z 53 PC: 14844 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:06:50.527864664Z 53 PC: 13976 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:06:50.52895027Z 53 PC: 13976 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:06:50.530372047Z 53 PC: 13976 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:06:50.53176707Z 53 PC: 13976 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:06:50.533190499Z 53 PC: 13976 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:06:50.535131663Z 53 PC: 13976 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:06:50.536514942Z 53 PC: 13976 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:06:50.537865322Z 53 PC: 13976 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:06:50.54031035Z 53 PC: 13976 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:06:50.541989908Z 53 PC: 13976 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:06:50.543074757Z 53 PC: 13976 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:06:50.544405244Z 53 PC: 13976 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:06:50.546138918Z 53 PC: 13976 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:06:50.552073383Z 53 PC: 13976 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:06:50.553453901Z 53 PC: 13976 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:06:50.554490641Z 53 PC: 13976 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:06:50.555492161Z 53 PC: 13976 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:06:50.557069333Z 53 PC: 13976 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:06:50.558451641Z 37 PC: 1398b | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:06:50.559540472Z 37 PC: 13993 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:06:50.560952982Z 37 PC: 1399b | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:06:50.562064097Z 37 PC: 139a3 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:06:50.563501205Z 68 PC: 140fc | I/O control for devices (Set for = '')
2018-12-17T23:06:50.599047925Z 37 PC: 133a7 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:06:50.607046912Z 48 PC: 14704 | Get DOS version
2018-12-17T23:06:50.608480568Z 61 PC: 14550 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:06:50.615131917Z 87 PC: 13172 | Get or set file date and time
2018-12-17T23:06:50.617503661Z 42 PC: 130b7 | Get date 0x130b7: xor ah, ah
0x130b9: les di, ptr [bp + 6]
0x130bc: stosw word ptr es:[di], ax
0x130bd: mov al, dl
0x130bf: les di, ptr [bp + 0xa]
0x130c2: stosw word ptr es:[di], ax
0x130c3: mov al, dh
0x130c5: les di, ptr [bp + 0xe]
0x130c8: stosw word ptr es:[di], ax
0x130c9: xchg ax, cx
0x130ca: les di, ptr [bp + 0x12]
0x130cd: stosw word ptr es:[di], ax
0x130ce: pop bp
0x130cf: retf 0x10
0x130d2: push bp
0x130d3: mov bp, sp
0x130d5: mov cx, word ptr [bp + 0xa]
0x130d8: mov dh, byte ptr [bp + 8]
0x130db: mov dl, byte ptr [bp + 6]
0x130de: mov ah, 0x2b
2018-12-17T23:06:50.623497847Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:06:50.625065041Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:06:50.626493115Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:06:50.627460385Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:06:50.628749473Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:06:50.640156138Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:06:50.641171772Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:06:50.642182263Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:06:50.64353966Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:06:50.644657905Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:06:50.64567726Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:06:50.646725895Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:06:50.647634759Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:06:50.6485324Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:06:50.649639395Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:06:50.650529346Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:06:50.651596622Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:06:50.652739007Z 37 PC: 13a85 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:06:50.653787575Z 76 PC: 13ac4 | Terminate with return code (Return code = '0')