Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Duke.16400

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:16:04.497598435Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:16:04.499654847Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:16:04.500721814Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:16:04.501791199Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:16:04.503360774Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:16:04.504714203Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:16:04.506039328Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:16:04.507619325Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:16:04.509293195Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:16:04.510302002Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:16:04.511841728Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:16:04.51320179Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:16:04.514329531Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:16:04.515983388Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:16:04.517160685Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:16:04.518253196Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:16:04.519492247Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:16:04.520778111Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:16:04.521914022Z 53 PC: 13b1a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:16:04.523143586Z 37 PC: 13b2f | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:16:04.524257507Z 37 PC: 13b37 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:16:04.525221828Z 37 PC: 13b3f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:16:04.526231482Z 37 PC: 13b47 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:16:04.528371018Z 68 PC: 14bbd | I/O control for devices
2018-12-17T22:16:04.529558931Z 44 PC: 14cf4 | Get time 0x14cf4: mov word ptr [0x17c6], cx
0x14cf8: mov word ptr [0x17c8], dx
0x14cfc: retf
0x14cfd: mov cx, di
0x14cff: mov si, 0xa
0x14d02: mov bx, dx
0x14d04: or bx, bx
0x14d06: jns 0x14d19
0x14d08: neg bx
0x14d0a: neg ax
0x14d0c: sbb bx, 0
0x14d0f: call 0x14d19
0x14d12: dec di
0x14d13: mov byte ptr es:[di], 0x2d
0x14d17: inc cx
0x14d18: ret
0x14d19: xor dx, dx
0x14d1b: xchg ax, bx
0x14d1c: div si
0x14d1e: xchg ax, bx
2018-12-17T22:16:04.531149721Z 25 PC: 14775 | Get default drive
2018-12-17T22:16:04.537357946Z 71 PC: 14788 | Get current directory
2018-12-17T22:16:04.539713911Z 14 PC: 12ab1 | Set default drive (Drive = 'A')
2018-12-17T22:16:04.540977082Z 26 PC: 13a05 | Set disk transfer address
2018-12-17T22:16:04.542314079Z 78 PC: 13a11 | Find first file
2018-12-17T22:16:04.546361402Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.547120424Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.549679936Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.550751431Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.554271607Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.55652022Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.559202489Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.560404975Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.573971236Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.575848852Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.578501452Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.580311594Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.584133622Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.585203457Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.588252582Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.589400818Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.592880699Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.594546923Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.597434316Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.598709649Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.602648633Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.603897811Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.607609173Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.609541721Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.612950011Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.613991143Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.618093039Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.61920205Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.622869152Z 26 PC: 13a29 | Set disk transfer address
2018-12-17T22:16:04.624904326Z 79 PC: 13a2e | Find next file
2018-12-17T22:16:04.627228547Z 14 PC: 12ab1 | Set default drive (Drive = 'A')
2018-12-17T22:16:04.628515119Z 14 PC: 147ce | Set default drive (Drive = 'A')
2018-12-17T22:16:04.630872975Z 25 PC: 147d2 | Get default drive
2018-12-17T22:16:04.632499409Z 64 PC: 1419b | Write file or device (Write 35 bytes on handle 1)
2018-12-17T22:16:04.637537987Z 64 PC: 1419b | Write file or device (Write 0 bytes on handle 1)
2018-12-17T22:16:04.640355469Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:16:04.641849811Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:16:04.643168914Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:16:04.645652653Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:16:04.647466932Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:16:04.648858023Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:16:04.650999242Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:16:04.652423545Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:16:04.653964771Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:16:04.656336354Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:16:04.657840169Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:16:04.659256305Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:16:04.66157628Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:16:04.663017527Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:16:04.665139808Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:16:04.667720032Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:16:04.669193956Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:16:04.670628136Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:16:04.672952129Z 37 PC: 13c71 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:16:04.676197009Z 76 PC: 13cb0 | Terminate with return code (Return code = '0')