Sample viewer

vx.netlux.org/Virus.DOS.Beer.3164.b

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:14:39.150462175Z 48 PC: 16f86 | Get DOS version
2018-12-17T22:14:39.153608837Z 53 PC: 17005 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:14:39.155328465Z 37 PC: 1703c | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:14:39.156943811Z 48 PC: 170c1 | Get DOS version
2018-12-17T22:14:39.172237694Z 53 PC: 170cb | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:14:39.173995394Z 37 PC: 170e0 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:14:39.175472485Z 47 PC: 170e6 | Get disk transfer address
2018-12-17T22:14:39.177459064Z 26 PC: 170f6 | Set disk transfer address
2018-12-17T22:14:39.179419498Z 78 PC: 17100 | Find first file
2018-12-17T22:14:39.186782238Z 53 PC: 9ef99 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:14:39.189386015Z 37 PC: 9ef99 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:14:39.19383173Z 67 PC: 9ef99 | Get or set file attributes
2018-12-17T22:14:39.199667614Z 67 PC: 9ef99 | Get or set file attributes
2018-12-17T22:14:39.218051783Z 61 PC: 9ef99 | Open file (Filename = 'JOIN.EXE')
2018-12-17T22:14:39.225348088Z 87 PC: 9ef99 | Get or set file date and time
2018-12-17T22:14:39.226805139Z 66 PC: 9ef99 | Move file pointer
2018-12-17T22:14:39.229391208Z 66 PC: 9ef99 | Move file pointer
2018-12-17T22:14:39.231266307Z 63 PC: 9ef99 | Read file or device (Read 28 bytes on handle 5)
2018-12-17T22:14:39.234184418Z 62 PC: 9ef99 | Close file
2018-12-17T22:14:39.236360273Z 42 PC: 9ef99 | Get date 0x9ef99: ret
0x9ef9a: push ds
0x9ef9b: pop es
0x9ef9c: push ds
0x9ef9d: pop word ptr cs:[0xd72]
0x9efa2: mov word ptr cs:[0xd70], dx
0x9efa7: mov ax, 0x4300
0x9efaa: call 0xaef93
0x9efad: jb 0x9ef7e
0x9efaf: test cx, 0x1e
0x9efb3: jne 0x9ef7e
0x9efb5: mov word ptr cs:[0xd76], cx
0x9efba: and cx, 0xfe
0x9efbe: mov dx, word ptr cs:[0xd70]
0x9efc3: mov ax, 0x4301
0x9efc6: call 0xaef93
0x9efc9: jb 0x9ef7e
0x9efcb: mov dx, word ptr cs:[0xd70]
0x9efd0: mov di, dx
0x9efd2: xor al, al
2018-12-17T22:14:39.241702338Z 37 PC: 9ef99 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:14:39.243531838Z 61 PC: 1710a | Open file (Filename = '^Xø')
2018-12-17T22:14:39.250234049Z 62 PC: 17112 | Close file
2018-12-17T22:14:39.260780785Z 79 PC: 1711e | Find next file
2018-12-17T22:14:39.263946274Z 37 PC: 17130 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:14:39.265973335Z 26 PC: 17139 | Set disk transfer address
2018-12-17T22:14:39.27159279Z 98 PC: 14ed8 | Get current PSP
2018-12-17T22:14:39.273440765Z 74 PC: 14f17 | Reallocate memory
2018-12-17T22:14:39.275585327Z 82 PC: 14f1d | Get DOS internal pointers (SYSVARS)
2018-12-17T22:14:39.296428602Z 25 PC: 15f73 | Get default drive
2018-12-17T22:14:39.298522603Z 13 PC: 15f28 | Disk reset
2018-12-17T22:14:39.30387747Z 99 PC: 13b0b | Get DBCS lead byte table pointer
2018-12-17T22:14:39.309496749Z 68 PC: 13b25 | I/O control for devices (Set for = '')
2018-12-17T22:14:39.311212585Z 68 PC: 13b30 | I/O control for devices (Set for = '')
2018-12-17T22:14:39.313214718Z 68 PC: 13b3b | I/O control for devices (Set for = '')
2018-12-17T22:14:39.317453803Z 68 PC: 13b43 | I/O control for devices (Set for = 'bgtS3[r2W<t<u6u>>W')
2018-12-17T22:14:39.31938131Z 48 PC: 13b48 | Get DOS version
2018-12-17T22:14:39.321294612Z 64 PC: 13dc1 | Write file or device (Write 23 bytes on handle 2)
2018-12-17T22:14:39.327019021Z 76 PC: 15f51 | Terminate with return code (Return code = '0')