Sample viewer

vx.netlux.org/Virus.DOS.AntiFort.1723

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:16:31.741334424Z 53 PC: 1411a | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-17T22:16:31.743046626Z 37 PC: 14131 | Set interrupt vector (Interrupt = '26' AKA 'Set disk transfer address')
2018-12-17T22:16:31.745409809Z 84 PC: 14399 | Get verify flag
2018-12-17T22:16:31.748244039Z 53 PC: 1433c | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:16:31.750087537Z 37 PC: 1434f | Set interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:16:31.751902257Z 48 PC: 12a63 | Get DOS version
2018-12-17T22:16:31.753326726Z 9 PC: 12a7a | Display string (String= ' --=[ Selfchecking AntiStealth Goat COM/EXE file, 01/06/01 ]=------------------ (c) 1995-2001 by ROSE SWE, Dipl.-Ing. Ralph Roth - Version 1.18 - Freeware ')
2018-12-17T22:16:31.781412243Z 61 PC: 12cb7 | Open file (Filename = '')
2018-12-17T22:16:31.839042212Z 9 PC: 12a88 | Display string (String= 'Self test: ')
2018-12-17T22:16:31.84113429Z 93 PC: 12b24 | File sharing functions
2018-12-17T22:16:31.843388118Z 9 PC: 12b03 | Display string (String= 'Size change=+06C6h/01734d. Virus might be activ? ')
2018-12-17T22:16:31.849541777Z 76 PC: 12b09 | Terminate with return code (Return code = '1')