Sample viewer

vx.netlux.org/Virus.DOS.Beer.3490.b

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:08:31.144284437Z 48 PC: 16f86 | Get DOS version
2018-12-17T23:08:31.146423728Z 53 PC: 17005 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:08:31.151573127Z 37 PC: 1703c | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:08:31.153420088Z 48 PC: 170c1 | Get DOS version
2018-12-17T23:08:31.155777068Z 53 PC: 170cb | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:08:31.158143807Z 37 PC: 170e0 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:08:31.159748052Z 47 PC: 170e6 | Get disk transfer address
2018-12-17T23:08:31.161331779Z 26 PC: 170f6 | Set disk transfer address
2018-12-17T23:08:31.166350071Z 78 PC: 17100 | Find first file
2018-12-17T23:08:31.173510189Z 53 PC: 9ef99 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:08:31.176261881Z 37 PC: 9ef99 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:08:31.186034099Z 67 PC: 9ef99 | Get or set file attributes
2018-12-17T23:08:31.201588113Z 67 PC: 9ef99 | Get or set file attributes
2018-12-17T23:08:31.219287381Z 61 PC: 9ef99 | Open file (Filename = 'FS.EXE')
2018-12-17T23:08:31.227617438Z 87 PC: 9ef99 | Get or set file date and time
2018-12-17T23:08:31.229653625Z 66 PC: 9ef99 | Move file pointer
2018-12-17T23:08:31.231250386Z 66 PC: 9ef99 | Move file pointer
2018-12-17T23:08:31.233402301Z 63 PC: 9ef99 | Read file or device (Read 28 bytes on handle 5)
2018-12-17T23:08:31.238000714Z 62 PC: 9ef99 | Close file
2018-12-17T23:08:31.240656886Z 42 PC: 9ef99 | Get date 0x9ef99: ret
0x9ef9a: push ds
0x9ef9b: pop es
0x9ef9c: push ds
0x9ef9d: pop word ptr cs:[0xeb8]
0x9efa2: mov word ptr cs:[0xeb6], dx
0x9efa7: mov ax, 0x4300
0x9efaa: call 0xaef93
0x9efad: jb 0x9ef7e
0x9efaf: test cx, 0x1e
0x9efb3: jne 0x9ef7e
0x9efb5: mov word ptr cs:[0xebc], cx
0x9efba: and cx, 0xfe
0x9efbe: mov dx, word ptr cs:[0xeb6]
0x9efc3: mov ax, 0x4301
0x9efc6: call 0xaef93
0x9efc9: jb 0x9ef7e
0x9efcb: mov dx, word ptr cs:[0xeb6]
0x9efd0: mov di, dx
0x9efd2: xor al, al
2018-12-17T23:08:31.244185519Z 37 PC: 9ef99 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:08:31.24683589Z 61 PC: 1710a | Open file (Filename = '^Xø')
2018-12-17T23:08:31.25472029Z 62 PC: 17112 | Close file
2018-12-17T23:08:31.257148834Z 79 PC: 1711e | Find next file
2018-12-17T23:08:31.264864527Z 37 PC: 17130 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:08:31.266593947Z 26 PC: 17139 | Set disk transfer address
2018-12-17T23:08:31.27008045Z 98 PC: 14ed8 | Get current PSP
2018-12-17T23:08:31.273037799Z 74 PC: 14f17 | Reallocate memory
2018-12-17T23:08:31.275034372Z 82 PC: 14f1d | Get DOS internal pointers (SYSVARS)
2018-12-17T23:08:31.27670937Z 25 PC: 15f73 | Get default drive
2018-12-17T23:08:31.278993353Z 13 PC: 15f28 | Disk reset
2018-12-17T23:08:31.282095924Z 99 PC: 13b0b | Get DBCS lead byte table pointer
2018-12-17T23:08:31.284122914Z 68 PC: 13b25 | I/O control for devices (Set for = '')
2018-12-17T23:08:31.286568962Z 68 PC: 13b30 | I/O control for devices (Set for = '')
2018-12-17T23:08:31.288646737Z 68 PC: 13b3b | I/O control for devices (Set for = '')
2018-12-17T23:08:31.290491384Z 68 PC: 13b43 | I/O control for devices (Set for = '��b���g�t�S3����[r�2��W�<t�<u�6�u����>��>W')
2018-12-17T23:08:31.293965433Z 48 PC: 13b48 | Get DOS version
2018-12-17T23:08:31.295700365Z 64 PC: 13dc1 | Write file or device (Write 23 bytes on handle 2)
2018-12-17T23:08:31.300753853Z 76 PC: 15f51 | Terminate with return code (Return code = '0')