Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Sioux.a

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:10:44.066682717Z 48 PC: 12a4c | Get DOS version
2018-12-17T23:10:44.069280651Z 53 PC: 12ba8 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:10:44.071128417Z 53 PC: 12bb5 | Get interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T23:10:44.073587792Z 53 PC: 12bc2 | Get interrupt vector (Interrupt = '5' AKA 'Printer output')
2018-12-17T23:10:44.075237596Z 53 PC: 12bcf | Get interrupt vector (Interrupt = '6' AKA 'Direct console I/O')
2018-12-17T23:10:44.086454335Z 37 PC: 12be3 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:10:44.088434153Z 74 PC: 12b19 | Reallocate memory
2018-12-17T23:10:44.094241724Z 42 PC: 150f4 | Get date 0x150f4: mov bx, word ptr [bp + 4]
0x150f7: mov word ptr [bx], cx
0x150f9: mov bx, word ptr [bp + 4]
0x150fc: mov word ptr [bx + 2], dx
0x150ff: pop bp
0x15100: ret
0x15101: push bp
0x15102: mov bp, sp
0x15104: mov ah, 0x2c
0x15106: int 0x21
0x15108: mov bx, word ptr [bp + 4]
0x1510b: mov word ptr [bx], cx
0x1510d: mov bx, word ptr [bp + 4]
0x15110: mov word ptr [bx + 2], dx
0x15113: pop bp
0x15114: ret
0x15115: push bp
0x15116: mov bp, sp
0x15118: sub sp, 2
0x1511b: push si
2018-12-17T23:10:44.09778925Z 26 PC: 150b9 | Set disk transfer address
2018-12-17T23:10:44.09954783Z 78 PC: 150c3 | Find first file
2018-12-17T23:10:44.106940062Z 61 PC: 1375d | Open file (Filename = ' .�U�����W�: sV6Q^~�+r�,�1����{ �ķ�����=')
2018-12-17T23:10:44.114827682Z 68 PC: 13a33 | I/O control for devices (Set for = '��f��')
2018-12-17T23:10:44.116502965Z 68 PC: 13a54 | I/O control for devices (Set for = '')
2018-12-17T23:10:44.119162523Z 61 PC: 1375d | Open file (Filename = 'f��`f[f^f_f]�')
2018-12-17T23:10:44.127227967Z 68 PC: 13a33 | I/O control for devices (Set for = '��f��')
2018-12-17T23:10:44.128870016Z 68 PC: 13a54 | I/O control for devices (Set for = '')
2018-12-17T23:10:44.13140687Z 63 PC: 13e74 | Read file or device (Read 512 bytes on handle 5)
2018-12-17T23:10:44.139953407Z 63 PC: 13e74 | Read file or device (Read 512 bytes on handle 6)
2018-12-17T23:10:44.148380834Z 62 PC: 13bed | Close file
2018-12-17T23:10:44.152046536Z 62 PC: 13bed | Close file
2018-12-17T23:10:44.155435926Z 26 PC: 150db | Set disk transfer address
2018-12-17T23:10:44.1568906Z 79 PC: 150df | Find next file
2018-12-17T23:10:44.160634146Z 55 PC: 1517b | Get or set switch character
2018-12-17T23:10:44.163697557Z 41 PC: 15690 | Parse filename
2018-12-17T23:10:44.165832205Z 41 PC: 1569e | Parse filename
2018-12-17T23:10:44.167591704Z 75 PC: 156de | Execute program
2018-12-17T23:10:44.190596686Z 80 PC: 26fc9 | Set current PSP
2018-12-17T23:10:44.193161528Z 48 PC: 26fce | Get DOS version
2018-12-17T23:10:44.195320554Z 99 PC: 2d7b0 | Get DBCS lead byte table pointer
2018-12-17T23:10:44.198665633Z 101 PC: 27054 | Get extended country info
2018-12-17T23:10:44.201540346Z 99 PC: 2705a | Get DBCS lead byte table pointer
2018-12-17T23:10:44.203783799Z 74 PC: 270bc | Reallocate memory
2018-12-17T23:10:44.205720515Z 25 PC: 270f3 | Get default drive
2018-12-17T23:10:44.208382517Z 37 PC: 26bb3 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T23:10:44.209846347Z 37 PC: 26bba | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:10:44.211343305Z 37 PC: 26bc1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:10:44.216669081Z 74 PC: 25d5c | Reallocate memory
2018-12-17T23:10:44.219573315Z 72 PC: 25d9d | Allocate memory
2018-12-17T23:10:44.22171655Z 72 PC: 25dd5 | Allocate memory
2018-12-17T23:10:44.224398044Z 72 PC: 25ddd | Allocate memory