Sample viewer

vx.netlux.org/Virus.DOS.MutaGen.100.Garden.1703

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:18:48.60220512Z 71 PC: 12b28 | Get current directory
2018-12-17T22:18:48.605588754Z 78 PC: 12b3f | Find first file
2018-12-17T22:18:48.61210571Z 61 PC: 12b5c | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:18:48.619889113Z 67 PC: 12b66 | Get or set file attributes
2018-12-17T22:18:48.638760293Z 64 PC: 12bf8 | Write file or device (Write 1737 bytes on handle 5)
2018-12-17T22:18:48.644284067Z 62 PC: 12b6d | Close file
2018-12-17T22:18:48.64966067Z 79 PC: 12b7f | Find next file
2018-12-17T22:18:48.651434804Z 61 PC: 12b5c | Open file (Filename = 'PRINT.COM')
2018-12-17T22:18:48.65581302Z 67 PC: 12b66 | Get or set file attributes
2018-12-17T22:18:48.663445136Z 64 PC: 12bf8 | Write file or device (Write 1737 bytes on handle 5)
2018-12-17T22:18:48.672691549Z 62 PC: 12b6d | Close file
2018-12-17T22:18:48.684059715Z 79 PC: 12b7f | Find next file
2018-12-17T22:18:48.686786857Z 61 PC: 12b5c | Open file (Filename = 'HELLO.COM')
2018-12-17T22:18:48.693636696Z 67 PC: 12b66 | Get or set file attributes
2018-12-17T22:18:48.707391521Z 64 PC: 12bf8 | Write file or device (Write 1754 bytes on handle 5)
2018-12-17T22:18:48.71782713Z 62 PC: 12b6d | Close file
2018-12-17T22:18:48.72683993Z 59 PC: 12b9d | Change current directory
2018-12-17T22:18:48.731896804Z 44 PC: 12ba3 | Get time 0x12ba3: mov ah, 9
0x12ba5: cmp dl, 0x32
0x12ba8: jbe 0x12bb1
0x12baa: lea dx, word ptr [bp + 0x197]
0x12bae: jmp 0x12bb5
0x12bb0: nop
0x12bb1: lea dx, word ptr [bp + 0x184]
0x12bb5: int 0x21
0x12bb7: mov ah, 0x3b
0x12bb9: lea dx, word ptr [bp + 0x2bb]
0x12bbd: int 0x21
0x12bbf: mov ah, 0x2a
0x12bc1: int 0x21
0x12bc3: cmp dl, 0x1b
0x12bc6: jne 0x12bdc
0x12bc8: mov ah, 0x56
0x12bca: lea dx, word ptr [bp + 0x11a]
0x12bce: lea di, word ptr [bp + 0x129]
0x12bd2: int 0x21
0x12bd4: mov ah, 9
2018-12-17T22:18:48.73417389Z 9 PC: 12bb7 | Display string (String= 'I need 4K more to start myself!')
2018-12-17T22:18:48.736592052Z 59 PC: 12bbf | Change current directory
2018-12-17T22:18:48.739346814Z 42 PC: 12bc3 | Get date 0x12bc3: cmp dl, 0x1b
0x12bc6: jne 0x12bdc
0x12bc8: mov ah, 0x56
0x12bca: lea dx, word ptr [bp + 0x11a]
0x12bce: lea di, word ptr [bp + 0x129]
0x12bd2: int 0x21
0x12bd4: mov ah, 9
0x12bd6: lea dx, word ptr [bp + 0x1b7]
0x12bda: int 0x21
0x12bdc: int 0x20
0x12bde: mov dx, 0x100
0x12be1: mov cx, 0x6a7
0x12be4: nop
0x12be5: lea si, word ptr [bp + 0x100]
0x12be9: lea di, word ptr [bp + 0x827]
0x12bed: call 0x12c3b
0x12bf0: lea dx, word ptr [bp + 0x827]
0x12bf4: mov ah, 0x40
0x12bf6: int 0x21
0x12bf8: jmp 0x12b69

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3215,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T13:06:51.263285124Z 71 PC: 12b28 | Get current directory
2018-12-25T13:06:51.266472158Z 78 PC: 12b3f | Find first file
2018-12-25T13:06:51.27224128Z 61 PC: 12b5c | Open file (Filename = 'SLEEP.COM')
2018-12-25T13:06:51.283297286Z 67 PC: 12b66 | Get or set file attributes
2018-12-25T13:06:51.302847983Z 64 PC: 12bf8 | Write file or device (Write 1753 bytes on handle 5)
2018-12-25T13:06:51.311251853Z 62 PC: 12b6d | Close file
2018-12-25T13:06:51.318905876Z 79 PC: 12b7f | Find next file
2018-12-25T13:06:51.322115411Z 61 PC: 12b5c | Open file (See above)
2018-12-25T13:06:51.328372351Z 67 PC: 12b66 | Get or set file attributes (See above)
2018-12-25T13:06:51.340398657Z 64 PC: 12bf8 | Write file or device (See above)
2018-12-25T13:06:51.349394767Z 62 PC: 12b6d | Close file (See above)
2018-12-25T13:06:51.357083139Z 79 PC: 12b7f | Find next file (See above)
2018-12-25T13:06:51.35959463Z 61 PC: 12b5c | Open file (See above)
2018-12-25T13:06:51.3711217Z 67 PC: 12b66 | Get or set file attributes (See above)
2018-12-25T13:06:51.383026212Z 64 PC: 12bf8 | Write file or device (See above)
2018-12-25T13:06:51.391430172Z 62 PC: 12b6d | Close file (See above)
2018-12-25T13:06:51.399316234Z 59 PC: 12b9d | Change current directory
2018-12-25T13:06:51.403388801Z 44 PC: 12ba3 | Get time 0x12ba3: mov ah, 9
0x12ba5: cmp dl, 0x32
0x12ba8: jbe 0x12bb1
0x12baa: lea dx, word ptr [bp + 0x197]
0x12bae: jmp 0x12bb5
0x12bb0: nop
0x12bb1: lea dx, word ptr [bp + 0x184]
0x12bb5: int 0x21
0x12bb7: mov ah, 0x3b
0x12bb9: lea dx, word ptr [bp + 0x2bb]
0x12bbd: int 0x21
0x12bbf: mov ah, 0x2a
0x12bc1: int 0x21
0x12bc3: cmp dl, 0x1b
0x12bc6: jne 0x12bdc
0x12bc8: mov ah, 0x56
0x12bca: lea dx, word ptr [bp + 0x11a]
0x12bce: lea di, word ptr [bp + 0x129]
0x12bd2: int 0x21
0x12bd4: mov ah, 9
2018-12-25T13:06:51.405319497Z 9 PC: 12bb7 | Display string (String= 'I need 4K more to start myself!')
2018-12-25T13:06:51.407558297Z 59 PC: 12bbf | Change current directory
2018-12-25T13:06:51.409830713Z 42 PC: 12bc3 | Get date 0x12bc3: cmp dl, 0x1b
0x12bc6: jne 0x12bdc
0x12bc8: mov ah, 0x56
0x12bca: lea dx, word ptr [bp + 0x11a]
0x12bce: lea di, word ptr [bp + 0x129]
0x12bd2: int 0x21
0x12bd4: mov ah, 9
0x12bd6: lea dx, word ptr [bp + 0x1b7]
0x12bda: int 0x21
0x12bdc: int 0x20
0x12bde: mov dx, 0x100
0x12be1: mov cx, 0x6a7
0x12be4: nop
0x12be5: lea si, word ptr [bp + 0x100]
0x12be9: lea di, word ptr [bp + 0x827]
0x12bed: call 0x12c3b
0x12bf0: lea dx, word ptr [bp + 0x827]
0x12bf4: mov ah, 0x40
0x12bf6: int 0x21
0x12bf8: jmp 0x12b69

{"DateBased":true,"Day":27,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3215,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:48:42.554445224Z 71 PC: 12b28 | Get current directory
2018-12-25T11:48:42.558039809Z 78 PC: 12b3f | Find first file
2018-12-25T11:48:42.565272868Z 61 PC: 12b5c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:48:42.578872712Z 67 PC: 12b66 | Get or set file attributes
2018-12-25T11:48:44.475611638Z 64 PC: 12bf8 | Write file or device (Write 1746 bytes on handle 5)
2018-12-25T11:48:44.489098285Z 62 PC: 12b6d | Close file
2018-12-25T11:48:44.503648058Z 79 PC: 12b7f | Find next file
2018-12-25T11:48:44.505895788Z 61 PC: 12b5c | Open file (See above)
2018-12-25T11:48:44.512141347Z 67 PC: 12b66 | Get or set file attributes (See above)
2018-12-25T11:48:44.520753806Z 64 PC: 12bf8 | Write file or device (See above)
2018-12-25T11:48:44.526501668Z 62 PC: 12b6d | Close file (See above)
2018-12-25T11:48:44.533844007Z 79 PC: 12b7f | Find next file (See above)
2018-12-25T11:48:44.537082612Z 61 PC: 12b5c | Open file (See above)
2018-12-25T11:48:44.545148656Z 67 PC: 12b66 | Get or set file attributes (See above)
2018-12-25T11:48:44.55886486Z 64 PC: 12bf8 | Write file or device (See above)
2018-12-25T11:48:44.568029224Z 62 PC: 12b6d | Close file (See above)
2018-12-25T11:48:44.57675634Z 59 PC: 12b9d | Change current directory
2018-12-25T11:48:44.597474549Z 44 PC: 12ba3 | Get time 0x12ba3: mov ah, 9
0x12ba5: cmp dl, 0x32
0x12ba8: jbe 0x12bb1
0x12baa: lea dx, word ptr [bp + 0x197]
0x12bae: jmp 0x12bb5
0x12bb0: nop
0x12bb1: lea dx, word ptr [bp + 0x184]
0x12bb5: int 0x21
0x12bb7: mov ah, 0x3b
0x12bb9: lea dx, word ptr [bp + 0x2bb]
0x12bbd: int 0x21
0x12bbf: mov ah, 0x2a
0x12bc1: int 0x21
0x12bc3: cmp dl, 0x1b
0x12bc6: jne 0x12bdc
0x12bc8: mov ah, 0x56
0x12bca: lea dx, word ptr [bp + 0x11a]
0x12bce: lea di, word ptr [bp + 0x129]
0x12bd2: int 0x21
0x12bd4: mov ah, 9
2018-12-25T11:48:44.601106559Z 9 PC: 12bb7 | Display string (String= 'I need 4K more to start myself!')
2018-12-25T11:48:44.622714052Z 59 PC: 12bbf | Change current directory
2018-12-25T11:48:44.62564593Z 42 PC: 12bc3 | Get date 0x12bc3: cmp dl, 0x1b
0x12bc6: jne 0x12bdc
0x12bc8: mov ah, 0x56
0x12bca: lea dx, word ptr [bp + 0x11a]
0x12bce: lea di, word ptr [bp + 0x129]
0x12bd2: int 0x21
0x12bd4: mov ah, 9
0x12bd6: lea dx, word ptr [bp + 0x1b7]
0x12bda: int 0x21
0x12bdc: int 0x20
0x12bde: mov dx, 0x100
0x12be1: mov cx, 0x6a7
0x12be4: nop
0x12be5: lea si, word ptr [bp + 0x100]
0x12be9: lea di, word ptr [bp + 0x827]
0x12bed: call 0x12c3b
0x12bf0: lea dx, word ptr [bp + 0x827]
0x12bf4: mov ah, 0x40
0x12bf6: int 0x21
0x12bf8: jmp 0x12b69
2018-12-25T11:48:44.628093473Z 86 PC: 12bd4 | Rename file
2018-12-25T11:48:45.282214684Z 9 PC: 12bdc | Display string (String= 'FUCK PEARL JAM!!!!LONG LIVE TECHNO!!!!')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3215,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:48:42.797598865Z 71 PC: 12b28 | Get current directory
2018-12-25T11:48:42.801377169Z 78 PC: 12b3f | Find first file
2018-12-25T11:48:42.808218634Z 61 PC: 12b5c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:48:42.81543536Z 67 PC: 12b66 | Get or set file attributes
2018-12-25T11:48:44.474747561Z 64 PC: 12bf8 | Write file or device (Write 1746 bytes on handle 5)
2018-12-25T11:48:44.484911591Z 62 PC: 12b6d | Close file
2018-12-25T11:48:44.494067553Z 79 PC: 12b7f | Find next file
2018-12-25T11:48:44.497559686Z 61 PC: 12b5c | Open file (See above)
2018-12-25T11:48:44.506209883Z 67 PC: 12b66 | Get or set file attributes (See above)
2018-12-25T11:48:44.520536803Z 64 PC: 12bf8 | Write file or device (See above)
2018-12-25T11:48:44.530581656Z 62 PC: 12b6d | Close file (See above)
2018-12-25T11:48:44.540144014Z 79 PC: 12b7f | Find next file (See above)
2018-12-25T11:48:44.544426778Z 61 PC: 12b5c | Open file (See above)
2018-12-25T11:48:44.552089536Z 67 PC: 12b66 | Get or set file attributes (See above)
2018-12-25T11:48:44.566863023Z 64 PC: 12bf8 | Write file or device (See above)
2018-12-25T11:48:44.576929041Z 62 PC: 12b6d | Close file (See above)
2018-12-25T11:48:44.587250286Z 59 PC: 12b9d | Change current directory
2018-12-25T11:48:44.593778781Z 44 PC: 12ba3 | Get time 0x12ba3: mov ah, 9
0x12ba5: cmp dl, 0x32
0x12ba8: jbe 0x12bb1
0x12baa: lea dx, word ptr [bp + 0x197]
0x12bae: jmp 0x12bb5
0x12bb0: nop
0x12bb1: lea dx, word ptr [bp + 0x184]
0x12bb5: int 0x21
0x12bb7: mov ah, 0x3b
0x12bb9: lea dx, word ptr [bp + 0x2bb]
0x12bbd: int 0x21
0x12bbf: mov ah, 0x2a
0x12bc1: int 0x21
0x12bc3: cmp dl, 0x1b
0x12bc6: jne 0x12bdc
0x12bc8: mov ah, 0x56
0x12bca: lea dx, word ptr [bp + 0x11a]
0x12bce: lea di, word ptr [bp + 0x129]
0x12bd2: int 0x21
0x12bd4: mov ah, 9
2018-12-25T11:48:44.596741914Z 9 PC: 12bb7 | Display string (String= 'I need 4K more to start myself!')
2018-12-25T11:48:44.600204528Z 59 PC: 12bbf | Change current directory
2018-12-25T11:48:44.603939012Z 42 PC: 12bc3 | Get date 0x12bc3: cmp dl, 0x1b
0x12bc6: jne 0x12bdc
0x12bc8: mov ah, 0x56
0x12bca: lea dx, word ptr [bp + 0x11a]
0x12bce: lea di, word ptr [bp + 0x129]
0x12bd2: int 0x21
0x12bd4: mov ah, 9
0x12bd6: lea dx, word ptr [bp + 0x1b7]
0x12bda: int 0x21
0x12bdc: int 0x20
0x12bde: mov dx, 0x100
0x12be1: mov cx, 0x6a7
0x12be4: nop
0x12be5: lea si, word ptr [bp + 0x100]
0x12be9: lea di, word ptr [bp + 0x827]
0x12bed: call 0x12c3b
0x12bf0: lea dx, word ptr [bp + 0x827]
0x12bf4: mov ah, 0x40
0x12bf6: int 0x21
0x12bf8: jmp 0x12b69

{"DateBased":true,"Day":27,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3215,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:48:43.065987363Z 71 PC: 12b28 | Get current directory
2018-12-25T11:48:43.068194329Z 78 PC: 12b3f | Find first file
2018-12-25T11:48:43.075650408Z 61 PC: 12b5c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:48:43.083338447Z 67 PC: 12b66 | Get or set file attributes
2018-12-25T11:48:44.473677164Z 64 PC: 12bf8 | Write file or device (Write 1744 bytes on handle 5)
2018-12-25T11:48:44.483928543Z 62 PC: 12b6d | Close file
2018-12-25T11:48:44.493199817Z 79 PC: 12b7f | Find next file
2018-12-25T11:48:44.496155588Z 61 PC: 12b5c | Open file (See above)
2018-12-25T11:48:44.510742181Z 67 PC: 12b66 | Get or set file attributes (See above)
2018-12-25T11:48:44.524599228Z 64 PC: 12bf8 | Write file or device (See above)
2018-12-25T11:48:44.534407428Z 62 PC: 12b6d | Close file (See above)
2018-12-25T11:48:44.544343157Z 79 PC: 12b7f | Find next file (See above)
2018-12-25T11:48:44.547650603Z 61 PC: 12b5c | Open file (See above)
2018-12-25T11:48:44.555343015Z 67 PC: 12b66 | Get or set file attributes (See above)
2018-12-25T11:48:44.568901505Z 64 PC: 12bf8 | Write file or device (See above)
2018-12-25T11:48:44.57503697Z 62 PC: 12b6d | Close file (See above)
2018-12-25T11:48:44.585055357Z 59 PC: 12b9d | Change current directory
2018-12-25T11:48:44.589954515Z 44 PC: 12ba3 | Get time 0x12ba3: mov ah, 9
0x12ba5: cmp dl, 0x32
0x12ba8: jbe 0x12bb1
0x12baa: lea dx, word ptr [bp + 0x197]
0x12bae: jmp 0x12bb5
0x12bb0: nop
0x12bb1: lea dx, word ptr [bp + 0x184]
0x12bb5: int 0x21
0x12bb7: mov ah, 0x3b
0x12bb9: lea dx, word ptr [bp + 0x2bb]
0x12bbd: int 0x21
0x12bbf: mov ah, 0x2a
0x12bc1: int 0x21
0x12bc3: cmp dl, 0x1b
0x12bc6: jne 0x12bdc
0x12bc8: mov ah, 0x56
0x12bca: lea dx, word ptr [bp + 0x11a]
0x12bce: lea di, word ptr [bp + 0x129]
0x12bd2: int 0x21
0x12bd4: mov ah, 9
2018-12-25T11:48:44.59307924Z 9 PC: 12bb7 | Display string (String= 'I need 4K more to start myself!')
2018-12-25T11:48:44.596040098Z 59 PC: 12bbf | Change current directory
2018-12-25T11:48:44.598333474Z 42 PC: 12bc3 | Get date 0x12bc3: cmp dl, 0x1b
0x12bc6: jne 0x12bdc
0x12bc8: mov ah, 0x56
0x12bca: lea dx, word ptr [bp + 0x11a]
0x12bce: lea di, word ptr [bp + 0x129]
0x12bd2: int 0x21
0x12bd4: mov ah, 9
0x12bd6: lea dx, word ptr [bp + 0x1b7]
0x12bda: int 0x21
0x12bdc: int 0x20
0x12bde: mov dx, 0x100
0x12be1: mov cx, 0x6a7
0x12be4: nop
0x12be5: lea si, word ptr [bp + 0x100]
0x12be9: lea di, word ptr [bp + 0x827]
0x12bed: call 0x12c3b
0x12bf0: lea dx, word ptr [bp + 0x827]
0x12bf4: mov ah, 0x40
0x12bf6: int 0x21
0x12bf8: jmp 0x12b69
2018-12-25T11:48:44.602157458Z 86 PC: 12bd4 | Rename file
2018-12-25T11:48:45.282715969Z 9 PC: 12bdc | Display string (String= 'FUCK PEARL JAM!!!!LONG LIVE TECHNO!!!!')