Sample viewer

vx.netlux.org/Virus.DOS.Weird.1800

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:08:52.550928012Z 48 PC: 13120 | Get DOS version
2018-12-17T23:08:52.56080867Z 44 PC: 13116 | Get time 0x13116: cmp dl, 0
0x13119: je 0x13112
0x1311b: ret
0x1311c: mov ah, 0x30
0x1311e: int 0x21
0x13120: ret
0x13121: add al, ch
0x13123: add byte ptr [bx + si], al
0x13125: pop bx
0x13126: sub bx, 4
0x13129: mov dl, byte ptr [bx]
0x1312b: sub bx, 0x6d5
0x1312f: cmp dl, 0
0x13132: je 0x1314a
0x13134: jmp 0x1313b
0x13136: nop
0x13137: lea bx, word ptr [bp + 0x10c]
0x1313b: mov dh, dl
0x1313d: mov cx, 0x6c5
0x13140: xor byte ptr [bx], dl
2018-12-17T23:08:52.56582877Z 48 PC: 13120 | Get DOS version
2018-12-17T23:08:52.567247229Z 25 PC: 12b86 | Get default drive
2018-12-17T23:08:52.56902448Z 71 PC: 12c08 | Get current directory
2018-12-17T23:08:52.573464734Z 53 PC: 12c26 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:08:52.575046221Z 37 PC: 12c36 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:08:52.576633612Z 53 PC: 12c48 | Get interrupt vector (Interrupt = '22' AKA 'Create or truncate file')
2018-12-17T23:08:52.578842927Z 44 PC: 13116 | Get time 0x13116: cmp dl, 0
0x13119: je 0x13112
0x1311b: ret
0x1311c: mov ah, 0x30
0x1311e: int 0x21
0x13120: ret
0x13121: add al, ch
0x13123: add byte ptr [bx + si], al
0x13125: pop bx
0x13126: sub bx, 4
0x13129: mov dl, byte ptr [bx]
0x1312b: sub bx, 0x6d5
0x1312f: cmp dl, 0
0x13132: je 0x1314a
0x13134: jmp 0x1313b
0x13136: nop
0x13137: lea bx, word ptr [bp + 0x10c]
0x1313b: mov dh, dl
0x1313d: mov cx, 0x6c5
0x13140: xor byte ptr [bx], dl
2018-12-17T23:08:52.581710453Z 37 PC: 12fda | Set interrupt vector (Interrupt = '208' AKA 'UNKNOWN!')
2018-12-17T23:08:52.583368227Z 47 PC: 12c0d | Get disk transfer address
2018-12-17T23:08:52.586131189Z 26 PC: 12c19 | Set disk transfer address
2018-12-17T23:08:52.587681139Z 44 PC: 13116 | Get time 0x13116: cmp dl, 0
0x13119: je 0x13112
0x1311b: ret
0x1311c: mov ah, 0x30
0x1311e: int 0x21
0x13120: ret
0x13121: call 0x13125
0x13125: pop bx
0x13126: sub bx, 4
0x13129: mov dl, byte ptr [bx]
0x1312b: sub bx, 0x6d5
0x1312f: cmp dl, 0
0x13132: je 0x1314a
0x13134: jmp 0x1313b
0x13136: nop
0x13137: lea bx, word ptr [bp + 0x10c]
0x1313b: mov dh, dl
0x1313d: mov cx, 0x6c5
0x13140: xor byte ptr [bx], dl
0x13142: sub dl, dh
2018-12-17T23:08:52.59051103Z 14 PC: 12cf1 | Set default drive (Drive = 'C')
2018-12-17T23:08:52.592774132Z 59 PC: 12f39 | Change current directory
2018-12-17T23:08:52.599490927Z 78 PC: 12a86 | Find first file
2018-12-17T23:08:52.6101908Z 61 PC: 12b46 | Open file (Filename = 'EDIT.COM')
2018-12-17T23:08:52.619057553Z 66 PC: 12b53 | Move file pointer
2018-12-17T23:08:52.621437774Z 63 PC: 12b5e | Read file or device (Read 1 bytes on handle 5)
2018-12-17T23:08:52.628102974Z 66 PC: 12d1b | Move file pointer
2018-12-17T23:08:52.630308346Z 62 PC: 12b3b | Close file
2018-12-17T23:08:52.632823261Z 79 PC: 12aec | Find next file
2018-12-17T23:08:52.636306266Z 61 PC: 12b46 | Open file (Filename = 'FORMAT.COM')
2018-12-17T23:08:52.643974982Z 66 PC: 12b53 | Move file pointer
2018-12-17T23:08:52.646371202Z 63 PC: 12b5e | Read file or device (Read 1 bytes on handle 5)
2018-12-17T23:08:52.654135646Z 66 PC: 12d1b | Move file pointer
2018-12-17T23:08:52.656253937Z 62 PC: 12b76 | Close file
2018-12-17T23:08:52.659517776Z 67 PC: 12f0e | Get or set file attributes
2018-12-17T23:08:52.666359849Z 67 PC: 12f1b | Get or set file attributes
2018-12-17T23:08:53.007569073Z 86 PC: 12bd5 | Rename file
2018-12-17T23:08:53.022521406Z 78 PC: 12aa7 | Find first file
2018-12-17T23:08:53.029667327Z 61 PC: 12ab0 | Open file (Filename = 'FORMAT.TXT')
2018-12-17T23:08:53.037678879Z 87 PC: 12d09 | Get or set file date and time
2018-12-17T23:08:53.040339953Z 63 PC: 12ac2 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T23:08:53.047244819Z 66 PC: 12d1b | Move file pointer
2018-12-17T23:08:53.049113296Z 66 PC: 12ad7 | Move file pointer
2018-12-17T23:08:53.051976294Z 64 PC: 12ae2 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T23:08:53.054976112Z 66 PC: 12d1b | Move file pointer
2018-12-17T23:08:53.057569385Z 64 PC: 132c1 | Write file or device (Write 1800 bytes on handle 5)
2018-12-17T23:08:53.070006796Z 87 PC: 12cff | Get or set file date and time
2018-12-17T23:08:53.072183123Z 62 PC: 12afd | Close file
2018-12-17T23:08:53.08081482Z 86 PC: 12bec | Rename file
2018-12-17T23:08:53.093354056Z 67 PC: 12f30 | Get or set file attributes
2018-12-17T23:08:53.105026689Z 78 PC: 12cc8 | Find first file
2018-12-17T23:08:53.111970771Z 78 PC: 12cc8 | Find first file
2018-12-17T23:08:53.118619796Z 78 PC: 12cc8 | Find first file
2018-12-17T23:08:53.126721323Z 26 PC: 12b0e | Set disk transfer address
2018-12-17T23:08:53.128534838Z 14 PC: 12b16 | Set default drive (Drive = 'A')
2018-12-17T23:08:53.131047158Z 59 PC: 12b1e | Change current directory
2018-12-17T23:08:53.137046207Z 37 PC: 12c41 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')