Sample viewer

vx.netlux.org/Virus.DOS.Dreg.596

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:09:30.493011269Z 53 PC: 12a52 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:09:30.494516899Z 37 PC: 12a6d | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:09:30.495553704Z 26 PC: 12a80 | Set disk transfer address
2018-12-17T22:09:30.496507735Z 78 PC: 12a9b | Find first file
2018-12-17T22:09:30.502624563Z 61 PC: 12aa6 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:09:30.508997799Z 63 PC: 12ab2 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:09:30.514973045Z 62 PC: 12adf | Close file
2018-12-17T22:09:30.517047568Z 67 PC: 12aea | Get or set file attributes
2018-12-17T22:09:30.533254909Z 61 PC: 12af3 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:09:30.539560591Z 44 PC: 12c1c | Get time 0x12c1c: pop cx
0x12c1d: push dx
0x12c1e: push cx
0x12c1f: ret
0x12c20: lea di, word ptr [bp + 0x109]
0x12c24: push di
0x12c25: pop si
0x12c26: mov cx, 0xdb
0x12c29: lodsw ax, word ptr [si]
0x12c2a: jmp 0x12c30
0x12c2c: stosw word ptr es:[di], ax
0x12c2d: loop 0x12c29
0x12c2f: ret
0x12c30: xor ax, word ptr [bp + 0x2c4]
0x12c34: xor ax, word ptr [bp + 0x2c6]
0x12c38: xor ax, word ptr [bp + 0x2c8]
0x12c3c: xor al, byte ptr [bp + 0x2ca]
0x12c40: xor ax, word ptr [bp + 0x2cc]
0x12c44: xor ax, word ptr [bp + 0x2ce]
0x12c48: xor ax, word ptr [bp + 0x2d0]
2018-12-17T22:09:30.541911957Z 44 PC: 12c1c | Get time 0x12c1c: pop cx
0x12c1d: push dx
0x12c1e: push cx
0x12c1f: ret
0x12c20: lea di, word ptr [bp + 0x109]
0x12c24: push di
0x12c25: pop si
0x12c26: mov cx, 0xdb
0x12c29: lodsw ax, word ptr [si]
0x12c2a: jmp 0x12c30
0x12c2c: stosw word ptr es:[di], ax
0x12c2d: loop 0x12c29
0x12c2f: ret
0x12c30: xor ax, word ptr [bp + 0x2c4]
0x12c34: xor ax, word ptr [bp + 0x2c6]
0x12c38: xor ax, word ptr [bp + 0x2c8]
0x12c3c: xor al, byte ptr [bp + 0x2ca]
0x12c40: xor ax, word ptr [bp + 0x2cc]
0x12c44: xor ax, word ptr [bp + 0x2ce]
0x12c48: xor ax, word ptr [bp + 0x2d0]
2018-12-17T22:09:30.543807069Z 44 PC: 12c1c | Get time 0x12c1c: pop cx
0x12c1d: push dx
0x12c1e: push cx
0x12c1f: ret
0x12c20: lea di, word ptr [bp + 0x109]
0x12c24: push di
0x12c25: pop si
0x12c26: mov cx, 0xdb
0x12c29: lodsw ax, word ptr [si]
0x12c2a: jmp 0x12c30
0x12c2c: stosw word ptr es:[di], ax
0x12c2d: loop 0x12c29
0x12c2f: ret
0x12c30: xor ax, word ptr [bp + 0x2c4]
0x12c34: xor ax, word ptr [bp + 0x2c6]
0x12c38: xor ax, word ptr [bp + 0x2c8]
0x12c3c: xor al, byte ptr [bp + 0x2ca]
0x12c40: xor ax, word ptr [bp + 0x2cc]
0x12c44: xor ax, word ptr [bp + 0x2ce]
0x12c48: xor ax, word ptr [bp + 0x2d0]
2018-12-17T22:09:30.545238262Z 44 PC: 12c1c | Get time 0x12c1c: pop cx
0x12c1d: push dx
0x12c1e: push cx
0x12c1f: ret
0x12c20: lea di, word ptr [bp + 0x109]
0x12c24: push di
0x12c25: pop si
0x12c26: mov cx, 0xdb
0x12c29: lodsw ax, word ptr [si]
0x12c2a: jmp 0x12c30
0x12c2c: stosw word ptr es:[di], ax
0x12c2d: loop 0x12c29
0x12c2f: ret
0x12c30: xor ax, word ptr [bp + 0x2c4]
0x12c34: xor ax, word ptr [bp + 0x2c6]
0x12c38: xor ax, word ptr [bp + 0x2c8]
0x12c3c: xor al, byte ptr [bp + 0x2ca]
0x12c40: xor ax, word ptr [bp + 0x2cc]
0x12c44: xor ax, word ptr [bp + 0x2ce]
0x12c48: xor ax, word ptr [bp + 0x2d0]
2018-12-17T22:09:30.546594763Z 44 PC: 12c1c | Get time 0x12c1c: pop cx
0x12c1d: push dx
0x12c1e: push cx
0x12c1f: ret
0x12c20: lea di, word ptr [bp + 0x109]
0x12c24: push di
0x12c25: pop si
0x12c26: mov cx, 0xdb
0x12c29: lodsw ax, word ptr [si]
0x12c2a: jmp 0x12c30
0x12c2c: stosw word ptr es:[di], ax
0x12c2d: loop 0x12c29
0x12c2f: ret
0x12c30: xor ax, word ptr [bp + 0x2c4]
0x12c34: xor ax, word ptr [bp + 0x2c6]
0x12c38: xor ax, word ptr [bp + 0x2c8]
0x12c3c: xor al, byte ptr [bp + 0x2ca]
0x12c40: xor ax, word ptr [bp + 0x2cc]
0x12c44: xor ax, word ptr [bp + 0x2ce]
0x12c48: xor ax, word ptr [bp + 0x2d0]
2018-12-17T22:09:30.548223476Z 44 PC: 12c1c | Get time 0x12c1c: pop cx
0x12c1d: push dx
0x12c1e: push cx
0x12c1f: ret
0x12c20: lea di, word ptr [bp + 0x109]
0x12c24: push di
0x12c25: pop si
0x12c26: mov cx, 0xdb
0x12c29: lodsw ax, word ptr [si]
0x12c2a: jmp 0x12c30
0x12c2c: stosw word ptr es:[di], ax
0x12c2d: loop 0x12c29
0x12c2f: ret
0x12c30: xor ax, word ptr [bp + 0x2c4]
0x12c34: xor ax, word ptr [bp + 0x2c6]
0x12c38: xor ax, word ptr [bp + 0x2c8]
0x12c3c: xor al, byte ptr [bp + 0x2ca]
0x12c40: xor ax, word ptr [bp + 0x2cc]
0x12c44: xor ax, word ptr [bp + 0x2ce]
0x12c48: xor ax, word ptr [bp + 0x2d0]
2018-12-17T22:09:30.549548111Z 44 PC: 12c1c | Get time 0x12c1c: pop cx
0x12c1d: push dx
0x12c1e: push cx
0x12c1f: ret
0x12c20: lea di, word ptr [bp + 0x109]
0x12c24: push di
0x12c25: pop si
0x12c26: mov cx, 0xdb
0x12c29: lodsw ax, word ptr [si]
0x12c2a: jmp 0x12c30
0x12c2c: stosw word ptr es:[di], ax
0x12c2d: loop 0x12c29
0x12c2f: ret
0x12c30: xor ax, word ptr [bp + 0x2c4]
0x12c34: xor ax, word ptr [bp + 0x2c6]
0x12c38: xor ax, word ptr [bp + 0x2c8]
0x12c3c: xor al, byte ptr [bp + 0x2ca]
0x12c40: xor ax, word ptr [bp + 0x2cc]
0x12c44: xor ax, word ptr [bp + 0x2ce]
0x12c48: xor ax, word ptr [bp + 0x2d0]
2018-12-17T22:09:30.551074301Z 66 PC: 12ca3 | Move file pointer
2018-12-17T22:09:30.552849286Z 64 PC: 12cbc | Write file or device (Write 596 bytes on handle 5)
2018-12-17T22:09:30.558056897Z 66 PC: 12cc5 | Move file pointer
2018-12-17T22:09:30.559011205Z 64 PC: 12cd0 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:09:30.563649818Z 87 PC: 12b68 | Get or set file date and time
2018-12-17T22:09:30.565057471Z 62 PC: 12b6c | Close file
2018-12-17T22:09:30.573223531Z 67 PC: 12b7b | Get or set file attributes
2018-12-17T22:09:30.583148342Z 26 PC: 12b8d | Set disk transfer address
2018-12-17T22:09:30.584092519Z 37 PC: 12b9e | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')