Sample viewer

vx.netlux.org/Virus.DOS.Zhengxi.7307

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T21:51:45.597445445Z 98 PC: 15393 | Get current PSP
2018-12-17T21:51:45.599192855Z 58 PC: 153fd | Remove subdirectory
2018-12-17T21:51:45.686099231Z 61 PC: 15719 | Open file (Filename = 'dí╣')
2018-12-17T21:51:45.691269238Z 25 PC: 14f20 | Get default drive
2018-12-17T21:51:45.707170926Z 98 PC: 15230 | Get current PSP
2018-12-17T21:51:45.710197979Z 37 PC: 13174 | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T21:51:45.712293735Z 51 PC: 136e2 | Get or set Ctrl-Break
2018-12-17T21:51:45.71543442Z 47 PC: 13700 | Get disk transfer address
2018-12-17T21:51:45.71658087Z 26 PC: 1370b | Set disk transfer address
2018-12-17T21:51:45.717647004Z 81 PC: 14195 | Get current PSP
2018-12-17T21:51:45.719429749Z 78 PC: 13712 | Find first file
2018-12-17T21:51:45.72554098Z 26 PC: 13718 | Set disk transfer address
2018-12-17T21:51:45.726833441Z 42 PC: 1371c | Get date 0x1371c: xor dx, word ptr [bp + 0x3d]
0x1371f: and dx, 0x18
0x13722: je 0x136fa
0x13724: mov ah, 0x51
0x13726: int 0x21
0x13728: mov es, bx
0x1372a: dec bx
0x1372b: mov ds, bx
0x1372d: mov bx, word ptr [3]
0x13731: sub bh, 7
0x13734: mov ah, 0x4a
0x13736: int 0x21
0x13738: mov ah, 0x48
0x1373a: mov bx, 0x6ff
0x1373d: int 0x21
0x1373f: jb 0x136fa
0x13741: cmp word ptr es:[0], 0x20cd
0x13748: jne 0x13750
0x1374a: sub byte ptr es:[3], 8
0x13750: dec ax
2018-12-17T21:51:46.004627135Z 9 PC: 12a82 | Display string (String= 'Goat file (EXE). Size=000007D0h/0000002000d bytes. ')
2018-12-17T21:51:46.010683556Z 76 PC: 12a86 | Terminate with return code (Return code = '36')