Sample viewer

vx.netlux.org/Virus.DOS.Bauhaus.974

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:13:38.968696891Z 75 PC: 12e0a | Execute program
2018-12-17T22:13:38.971296972Z 42 PC: 12d3e | Get date 0x12d3e: mov byte ptr [0x14d], dl
0x12d42: mov word ptr [0x14b], ds
0x12d46: mov ax, 0x11f
0x12d49: mov word ptr [0x152], ax
0x12d4c: call 0x22afc
0x12d4f: mov ax, 0x3521
0x12d52: int 0x21
0x12d54: mov word ptr [0x13f], bx
0x12d58: mov word ptr [0x141], es
0x12d5c: mov ax, 0x3515
0x12d5f: int 0x21
0x12d61: mov word ptr [0x143], bx
0x12d65: mov word ptr [0x145], es
0x12d69: pop es
0x12d6a: pop bx
0x12d6b: mov ax, 0x2521
0x12d6e: mov dx, 0x3a3
0x12d71: int 0x21
0x12d73: cmp byte ptr [0x14d], 0x1c
0x12d78: jne 0x12d82
2018-12-17T22:13:38.973453144Z 61 PC: 12b45 | Open file (Filename = 'C:\DOS\KEYB.COM')
2018-12-17T22:13:38.983080578Z 87 PC: 12b55 | Get or set file date and time
2018-12-17T22:13:39.364713805Z 26 PC: 12bad | Set disk transfer address
2018-12-17T22:13:39.366736547Z 78 PC: 12bb8 | Find first file
2018-12-17T22:13:39.376227719Z 60 PC: 12be0 | Create or truncate file
2018-12-17T22:13:39.386575472Z 64 PC: 12c1b | Write file or device (Write 974 bytes on handle 6)
2018-12-17T22:13:39.39570853Z 63 PC: 12c30 | Read file or device (Read 30720 bytes on handle 5)
2018-12-17T22:13:39.404871349Z 64 PC: 12c77 | Write file or device (Write 15750 bytes on handle 6)
2018-12-17T22:13:39.418853691Z 63 PC: 12c30 | Read file or device (Read 30720 bytes on handle 5)
2018-12-17T22:13:39.421661527Z 87 PC: 12c9c | Get or set file date and time
2018-12-17T22:13:39.423186146Z 62 PC: 12ad9 | Close file
2018-12-17T22:13:39.430209569Z 62 PC: 12ae2 | Close file
2018-12-17T22:13:39.432307587Z 65 PC: 12cae | Delete file (Filename = 'S')
2018-12-17T22:13:39.443174039Z 86 PC: 12cc5 | Rename file
2018-12-17T22:13:39.45585438Z 53 PC: 12d54 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:13:39.457979597Z 53 PC: 12d61 | Get interrupt vector (Interrupt = '21' AKA 'Sequential write')
2018-12-17T22:13:39.459353474Z 37 PC: 12d73 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:13:39.460926541Z 74 PC: 12d8f | Reallocate memory
2018-12-17T22:13:39.464012531Z 61 PC: 12b45 | Open file (Filename = 'A:\TEST.COM')
2018-12-17T22:13:39.471006541Z 87 PC: 12b55 | Get or set file date and time
2018-12-17T22:13:39.483847648Z 26 PC: 12bad | Set disk transfer address
2018-12-17T22:13:39.486600075Z 78 PC: 12bb8 | Find first file
2018-12-17T22:13:39.492563521Z 60 PC: 12be0 | Create or truncate file
2018-12-17T22:13:39.503205435Z 64 PC: 12c1b | Write file or device (Write 974 bytes on handle 6)
2018-12-17T22:13:39.511590123Z 63 PC: 12c30 | Read file or device (Read 30720 bytes on handle 5)
2018-12-17T22:13:39.518443733Z 64 PC: 12c77 | Write file or device (Write 1247 bytes on handle 6)
2018-12-17T22:13:39.526424581Z 63 PC: 12c30 | Read file or device (Read 30720 bytes on handle 5)
2018-12-17T22:13:39.52846227Z 87 PC: 12c9c | Get or set file date and time
2018-12-17T22:13:39.530204994Z 62 PC: 12ad9 | Close file
2018-12-17T22:13:39.537416549Z 62 PC: 12ae2 | Close file
2018-12-17T22:13:39.539311879Z 65 PC: 12cae | Delete file (Filename = '')
2018-12-17T22:13:39.5514721Z 86 PC: 12cc5 | Rename file
2018-12-17T22:13:39.562565283Z 75 PC: 12dc3 | Execute program
2018-12-17T22:13:39.581490747Z 76 PC: 12f8b | Terminate with return code (Return code = '1')
2018-12-17T22:13:39.585257639Z 73 PC: 12ddc | Release memory