Sample viewer

vx.netlux.org/Virus.DOS.Vici.a

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:04:50.615896273Z 53 PC: 1365a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:04:50.617588491Z 53 PC: 1365a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:04:50.619108031Z 53 PC: 1365a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:04:50.620406288Z 53 PC: 1365a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:04:50.62218817Z 53 PC: 1365a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:04:50.623682332Z 53 PC: 1365a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:04:50.625391914Z 53 PC: 1365a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:04:50.627212475Z 53 PC: 1365a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:04:50.628803061Z 53 PC: 1365a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:04:50.63010076Z 53 PC: 1365a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:04:50.631601116Z 53 PC: 1365a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:04:50.632953703Z 53 PC: 1365a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:04:50.633990109Z 53 PC: 1365a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:04:50.634960955Z 53 PC: 1365a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:04:50.63667043Z 53 PC: 1365a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:04:50.637747454Z 53 PC: 1365a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:04:50.638755018Z 53 PC: 1365a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:04:50.640142218Z 53 PC: 1365a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:04:50.641043597Z 53 PC: 1365a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:04:50.641921805Z 37 PC: 1366f | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:04:50.643558471Z 37 PC: 13677 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:04:50.644810221Z 37 PC: 1367f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:04:50.645939176Z 37 PC: 13687 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:04:50.648024888Z 68 PC: 14194 | I/O control for devices (Set for = '')
2018-12-17T22:04:50.649269551Z 54 PC: 132ec | Get free disk space
2018-12-17T22:04:50.692369171Z 54 PC: 132ec | Get free disk space
2018-12-17T22:04:50.694399842Z 54 PC: 132ec | Get free disk space
2018-12-17T22:04:50.695781908Z 54 PC: 132ec | Get free disk space
2018-12-17T22:04:50.697159756Z 54 PC: 132ec | Get free disk space
2018-12-17T22:04:50.717580618Z 54 PC: 132ec | Get free disk space
2018-12-17T22:04:50.718748124Z 44 PC: 142cb | Get time 0x142cb: mov word ptr [0x4a], cx
0x142cf: mov word ptr [0x4c], dx
0x142d3: retf
0x142d4: mov di, 0x5c
0x142d7: push ds
0x142d8: pop es
0x142d9: mov cx, 0xfc22
0x142dc: sub cx, di
0x142de: shr cx, 1
0x142e0: xor ax, ax
0x142e2: cld
0x142e3: rep stosd dword ptr es:[di], eax
0x142e5: ret
0x142e6: add byte ptr [bx + si], al
0x142e8: add byte ptr [bx + si], al
0x142ea: add byte ptr [bx + si], al
0x142ec: add byte ptr [bx + si], al
0x142ee: add byte ptr [bx + si], al
0x142f0: add byte ptr [bx + si], al
0x142f2: add word ptr [bp + di + 1], sp
2018-12-17T22:04:50.720583053Z 26 PC: 13381 | Set disk transfer address
2018-12-17T22:04:50.722255243Z 78 PC: 1338d | Find first file
2018-12-17T22:04:50.730943209Z 26 PC: 13381 | Set disk transfer address
2018-12-17T22:04:50.732438934Z 78 PC: 1338d | Find first file
2018-12-17T22:04:50.739074893Z 26 PC: 133a5 | Set disk transfer address
2018-12-17T22:04:50.740681859Z 79 PC: 133aa | Find next file
2018-12-17T22:04:50.743675498Z 26 PC: 133a5 | Set disk transfer address
2018-12-17T22:04:50.745598287Z 79 PC: 133aa | Find next file
2018-12-17T22:04:50.747982226Z 44 PC: 142cb | Get time 0x142cb: mov word ptr [0x4a], cx
0x142cf: mov word ptr [0x4c], dx
0x142d3: retf
0x142d4: mov di, 0x5c
0x142d7: push ds
0x142d8: pop es
0x142d9: mov cx, 0xfc22
0x142dc: sub cx, di
0x142de: shr cx, 1
0x142e0: xor ax, ax
0x142e2: cld
0x142e3: rep stosd dword ptr es:[di], eax
0x142e5: ret
0x142e6: add byte ptr [bx + si], al
0x142e8: add byte ptr [bx + si], al
0x142ea: add byte ptr [bx + si], al
0x142ec: add byte ptr [bx + si], al
0x142ee: add byte ptr [bx + si], al
0x142f0: add byte ptr [bx + si], al
0x142f2: add word ptr [bp + di + 1], sp
2018-12-17T22:04:50.750613075Z 26 PC: 13381 | Set disk transfer address
2018-12-17T22:04:50.751787567Z 78 PC: 1338d | Find first file
2018-12-17T22:04:50.762130482Z 48 PC: 1357d | Get DOS version
2018-12-17T22:04:50.764660384Z 86 PC: 13f0d | Rename file
2018-12-17T22:04:51.193347733Z 61 PC: 13d80 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:04:51.203651289Z 60 PC: 13d80 | Create or truncate file
2018-12-17T22:04:51.211728571Z 63 PC: 13e53 | Read file or device (Read 4571 bytes on handle 5)
2018-12-17T22:04:51.219864122Z 64 PC: 13e53 | Write file or device (Write 4571 bytes on handle 6)
2018-12-17T22:04:51.231859086Z 62 PC: 13dd0 | Close file
2018-12-17T22:04:51.233382874Z 61 PC: 13d80 | Open file (Filename = 'c:\DOS\vic1-0.exe')
2018-12-17T22:04:51.239427946Z 63 PC: 13e53 | Read file or device (Read 63000 bytes on handle 5)
2018-12-17T22:04:51.245093581Z 64 PC: 13e53 | Write file or device (Write 11208 bytes on handle 6)
2018-12-17T22:04:51.253529579Z 87 PC: 13351 | Get or set file date and time
2018-12-17T22:04:51.255078414Z 62 PC: 13dd0 | Close file
2018-12-17T22:04:51.260640065Z 62 PC: 13dd0 | Close file
2018-12-17T22:04:51.262062135Z 65 PC: 13ec9 | Delete file (Filename = 'c:\DOS\vic1-0.exe')
2018-12-17T22:04:51.268821607Z 42 PC: 13277 | Get date 0x13277: xor ah, ah
0x13279: les di, ptr [bp + 6]
0x1327c: stosw word ptr es:[di], ax
0x1327d: mov al, dl
0x1327f: les di, ptr [bp + 0xa]
0x13282: stosw word ptr es:[di], ax
0x13283: mov al, dh
0x13285: les di, ptr [bp + 0xe]
0x13288: stosw word ptr es:[di], ax
0x13289: xchg ax, cx
0x1328a: les di, ptr [bp + 0x12]
0x1328d: stosw word ptr es:[di], ax
0x1328e: pop bp
0x1328f: retf 0x10
0x13292: push bp
0x13293: mov bp, sp
0x13295: mov cx, word ptr [bp + 0xa]
0x13298: mov dh, byte ptr [bp + 8]
0x1329b: mov dl, byte ptr [bp + 6]
0x1329e: mov ah, 0x2b
2018-12-17T22:04:51.271416671Z 60 PC: 13d80 | Create or truncate file
2018-12-17T22:04:51.279070947Z 62 PC: 13dd0 | Close file
2018-12-17T22:04:51.28067771Z 86 PC: 13f0d | Rename file
2018-12-17T22:04:51.295075485Z 61 PC: 13d80 | Open file (Filename = 'vic1--0.exe')
2018-12-17T22:04:51.300054413Z 60 PC: 13d80 | Create or truncate file
2018-12-17T22:04:51.307981055Z 66 PC: 13eb2 | Move file pointer
2018-12-17T22:04:51.310082893Z 63 PC: 13e53 | Read file or device (Read 63000 bytes on handle 5)
2018-12-17T22:04:51.315544026Z 64 PC: 13e53 | Write file or device (Write 2357 bytes on handle 6)
2018-12-17T22:04:51.321313795Z 62 PC: 13dd0 | Close file
2018-12-17T22:04:51.323423721Z 62 PC: 13dd0 | Close file
2018-12-17T22:04:51.341706828Z 53 PC: 134fe | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:04:51.343465101Z 37 PC: 13507 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:04:51.346137181Z 53 PC: 134fe | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:04:51.347813193Z 37 PC: 13507 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:04:51.349218181Z 53 PC: 134fe | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:04:51.353420798Z 37 PC: 13507 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:04:51.354878579Z 53 PC: 134fe | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:04:51.356473502Z 37 PC: 13507 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:04:51.358779874Z 53 PC: 134fe | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:04:51.360395135Z 37 PC: 13507 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:04:51.361761221Z 53 PC: 134fe | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:04:51.363812843Z 37 PC: 13507 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:04:51.36516823Z 53 PC: 134fe | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:04:51.366559862Z 37 PC: 13507 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:04:51.368920589Z 53 PC: 134fe | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:04:51.37030354Z 37 PC: 13507 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:04:51.371594849Z 53 PC: 134fe | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:04:51.373157795Z 37 PC: 13507 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:04:51.375040618Z 53 PC: 134fe | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:04:51.376386242Z 37 PC: 13507 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:04:51.377715052Z 53 PC: 134fe | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:04:51.380532045Z 37 PC: 13507 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:04:51.381848991Z 53 PC: 134fe | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:04:51.383273973Z 37 PC: 13507 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:04:51.385451695Z 53 PC: 134fe | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:04:51.38681683Z 37 PC: 13507 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:04:51.388123472Z 53 PC: 134fe | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:04:51.391040302Z 37 PC: 13507 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:04:51.392329062Z 53 PC: 134fe | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:04:51.393656108Z 37 PC: 13507 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:04:51.396221019Z 53 PC: 134fe | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:04:51.397998534Z 37 PC: 13507 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:04:51.399068382Z 53 PC: 134fe | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:04:51.401202005Z 37 PC: 13507 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:04:51.402643986Z 53 PC: 134fe | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:04:51.40406491Z 37 PC: 13507 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:04:51.406095019Z 53 PC: 134fe | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:04:51.407521968Z 37 PC: 13507 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:04:51.409024073Z 41 PC: 134b5 | Parse filename
2018-12-17T22:04:51.41140522Z 41 PC: 134c3 | Parse filename
2018-12-17T22:04:51.412996397Z 75 PC: 134ce | Execute program
2018-12-17T22:04:51.430269171Z 53 PC: 134fe | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:04:51.432195096Z 37 PC: 13507 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:04:51.433505693Z 53 PC: 134fe | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:04:51.434914645Z 37 PC: 13507 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:04:51.43722361Z 53 PC: 134fe | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:04:51.439126182Z 37 PC: 13507 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:04:51.440481705Z 53 PC: 134fe | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:04:51.442572248Z 37 PC: 13507 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:04:51.444311123Z 53 PC: 134fe | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:04:51.445711763Z 37 PC: 13507 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:04:51.447260302Z 53 PC: 134fe | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:04:51.449513744Z 37 PC: 13507 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:04:51.450857756Z 53 PC: 134fe | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:04:51.452229375Z 37 PC: 13507 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:04:51.454539124Z 53 PC: 134fe | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:04:51.455951981Z 37 PC: 13507 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:04:51.457300792Z 53 PC: 134fe | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:04:51.459284295Z 37 PC: 13507 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:04:51.460697792Z 53 PC: 134fe | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:04:51.462556047Z 37 PC: 13507 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:04:51.46456728Z 53 PC: 134fe | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:04:51.465946284Z 37 PC: 13507 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:04:51.467273442Z 53 PC: 134fe | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:04:51.469742014Z 37 PC: 13507 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:04:51.471199939Z 53 PC: 134fe | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:04:51.472672139Z 37 PC: 13507 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:04:51.474621955Z 53 PC: 134fe | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:04:51.475957154Z 37 PC: 13507 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:04:51.477305787Z 53 PC: 134fe | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:04:51.47939377Z 37 PC: 13507 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:04:51.481352067Z 53 PC: 134fe | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:04:51.482458327Z 37 PC: 13507 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:04:51.484564577Z 53 PC: 134fe | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:04:51.485700524Z 37 PC: 13507 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:04:51.486742507Z 53 PC: 134fe | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:04:51.488415512Z 37 PC: 13507 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:04:51.489510062Z 53 PC: 134fe | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:04:51.490667814Z 37 PC: 13507 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:04:51.492521972Z 65 PC: 13ec9 | Delete file (Filename = '��')
2018-12-17T22:04:51.504432347Z 86 PC: 13f0d | Rename file
2018-12-17T22:04:51.51688586Z 64 PC: 13cdb | Write file or device (Write 0 bytes on handle 1)
2018-12-17T22:04:51.519924858Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:04:51.521176259Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:04:51.522277561Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:04:51.524180918Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:04:51.525788996Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:04:51.527221124Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:04:51.529424526Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:04:51.530859473Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:04:51.532289459Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:04:51.534948517Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:04:51.536281961Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:04:51.537693816Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:04:51.53992775Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:04:51.541570843Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:04:51.542973844Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:04:51.54498535Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:04:51.547237257Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:04:51.548439039Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:04:51.550401581Z 37 PC: 137b1 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:04:51.551816039Z 76 PC: 137f0 | Terminate with return code (Return code = '0')