Sample viewer

vx.netlux.org/Virus.DOS.Altx.2297

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:12:51.8046326Z 11 PC: 17a1e | Get input status
2018-12-17T23:12:51.808229675Z 42 PC: 17a1e | Get date 0x17a1e: ret
0x17a1f: mov si, 0x2f
0x17a22: mov di, si
0x17a24: mov cx, 0x463
0x17a27: lodsw ax, word ptr [si]
0x17a28: xor ax, 0x208
0x17a2b: stosw word ptr es:[di], ax
0x17a2c: loop 0x17a27
0x17a2e: ret
0x17a2f: mov ax, 0x440b
0x17a32: mov bx, 0x1998
0x17a35: mov cx, 0x208
0x17a38: call 0x27a1a
0x17a3b: cmp bx, 0x208
0x17a3f: jne 0x17a51
0x17a41: cmp cx, 0x1998
0x17a45: jne 0x17a51
0x17a47: or dx, dx
0x17a49: je 0x17a4e
0x17a4b: call 0x17d8f
2018-12-17T23:12:51.811024002Z 74 PC: 17a1e | Reallocate memory
2018-12-17T23:12:51.81303166Z 74 PC: 17a1e | Reallocate memory
2018-12-17T23:12:51.815704666Z 72 PC: 17a1e | Allocate memory
2018-12-17T23:12:51.817694503Z 72 PC: 17a1e | Allocate memory
2018-12-17T23:12:51.819802923Z 53 PC: 17a1e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:12:51.82159568Z 37 PC: 17a1e | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:12:51.82411734Z 53 PC: 17a1e | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T23:12:51.8306068Z 37 PC: 17a1e | Set interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T23:12:51.86083404Z 48 PC: 12a4c | Get DOS version
2018-12-17T23:12:51.86363856Z 53 PC: 12bc0 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:12:51.86597409Z 53 PC: 12bcd | Get interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T23:12:51.868144691Z 53 PC: 12bda | Get interrupt vector (Interrupt = '5' AKA 'Printer output')
2018-12-17T23:12:51.885771687Z 53 PC: 12be7 | Get interrupt vector (Interrupt = '6' AKA 'Direct console I/O')
2018-12-17T23:12:51.887352896Z 37 PC: 12bfb | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:12:51.889178009Z 74 PC: 12ad6 | Reallocate memory
2018-12-17T23:12:51.893156784Z 68 PC: 12fbe | I/O control for devices (Set for = '')
2018-12-17T23:12:51.895764572Z 74 PC: 149b2 | Reallocate memory
2018-12-17T23:12:51.898141777Z 74 PC: 149b2 | Reallocate memory
2018-12-17T23:12:51.90023979Z 68 PC: 12fbe | I/O control for devices (Set for = 'Borland C++ - Copyright 1991 Borland Intl.')
2018-12-17T23:12:51.905766166Z 51 PC: 12e40 | Get or set Ctrl-Break
2018-12-17T23:12:51.907204834Z 37 PC: 12e9c | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:12:51.909942511Z 37 PC: 12e9c | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:12:51.922183089Z 64 PC: 16029 | Write file or device (Write 30 bytes on handle 1)
2018-12-17T23:12:51.928037685Z 64 PC: 16029 | Write file or device (Write 28 bytes on handle 1)
2018-12-17T23:12:51.934626365Z 64 PC: 16029 | Write file or device (Write 23 bytes on handle 1)
2018-12-17T23:12:51.94090886Z 53 PC: 12e89 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:12:51.944110808Z 53 PC: 12e89 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:12:51.94800958Z 53 PC: 12e89 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:12:51.952145103Z 53 PC: 12e89 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:12:51.955423144Z 53 PC: 12e89 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:12:52.080956524Z 64 PC: 16029 | Write file or device (Write 30 bytes on handle 1)
2018-12-17T23:12:52.089621199Z 67 PC: 14aa0 | Get or set file attributes
2018-12-17T23:12:52.097320043Z 61 PC: 15464 | Open file (Filename = '')
2018-12-17T23:12:52.108713326Z 64 PC: 16029 | Write file or device (Write 61 bytes on handle 1)
2018-12-17T23:12:52.115857964Z 37 PC: 12c07 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:12:52.118164322Z 37 PC: 12c12 | Set interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T23:12:52.120790632Z 37 PC: 12c1d | Set interrupt vector (Interrupt = '5' AKA 'Printer output')
2018-12-17T23:12:52.123553044Z 37 PC: 12c28 | Set interrupt vector (Interrupt = '6' AKA 'Direct console I/O')
2018-12-17T23:12:52.126107335Z 76 PC: 12bb1 | Terminate with return code (Return code = '1')