{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3738,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:50:02.48405135Z | 71 | PC: 12a76 | Get current directory |
| 2018-12-25T11:50:02.487891289Z | 53 | PC: 12bba | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:50:02.489089168Z | 53 | PC: 12a88 | Get interrupt vector (Interrupt = '42' AKA 'Get date') |
| 2018-12-25T11:50:02.492182895Z | 37 | PC: 12bca | Set interrupt vector (Interrupt = '42' AKA 'Get date') |
| 2018-12-25T11:50:02.494290547Z | 26 | PC: 12aa2 | Set disk transfer address |
| 2018-12-25T11:50:02.495616707Z | 78 | PC: 12bca | Find first file (See above) |
| 2018-12-25T11:50:02.501704773Z | 61 | PC: 12bca | Open file (See above) |
| 2018-12-25T11:50:02.50920896Z | 63 | PC: 12bca | Read file or device (See above) |
| 2018-12-25T11:50:02.515568359Z | 64 | PC: 12bca | Write file or device (See above) |
| 2018-12-25T11:50:03.603952802Z | 64 | PC: 12bca | Write file or device (See above) |
| 2018-12-25T11:50:03.621666189Z | 62 | PC: 12bca | Close file (See above) |
| 2018-12-25T11:50:03.692515083Z | 59 | PC: 12b19 | Change current directory |
| 2018-12-25T11:50:03.694151303Z | 26 | PC: 12b20 | Set disk transfer address |
| 2018-12-25T11:50:03.695433908Z | 37 | PC: 12bca | Set interrupt vector (See above) |
| 2018-12-25T11:50:03.697041076Z | 42 | PC: 12b32 | Get date 0x12b32: cmp dx, 0x701 0x12b36: jne 0x12b40 0x12b38: mov ah, 9 0x12b3a: lea dx, word ptr [si + 0x2e8] 0x12b3e: int 0x21 0x12b40: push 0x100 0x12b43: ret 0x12b44: mov ax, word ptr es:[di + 0x11] 0x12b48: mov word ptr es:[di + 0x15], ax 0x12b4c: sub ax, 3 0x12b4f: mov word ptr [si + 0x2e5], ax 0x12b53: mov ah, 0x40 0x12b55: mov cx, 0x22d 0x12b58: lea dx, word ptr [si + 0x104] 0x12b5c: call 0x12bc3 0x12b5f: mov word ptr es:[di + 0x15], 0 0x12b65: mov ah, 0x40 0x12b67: mov cx, 4 0x12b6a: lea dx, word ptr [si + 0x2e4] 0x12b6e: call 0x12bc3 |
{"DateBased":true,"Day":1,"Month":7,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3738,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:50:02.546073008Z | 71 | PC: 12a76 | Get current directory |
| 2018-12-25T11:50:02.550441903Z | 53 | PC: 12bba | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:50:02.552419207Z | 53 | PC: 12a88 | Get interrupt vector (Interrupt = '42' AKA 'Get date') |
| 2018-12-25T11:50:02.554354409Z | 37 | PC: 12bca | Set interrupt vector (Interrupt = '42' AKA 'Get date') |
| 2018-12-25T11:50:02.556703364Z | 26 | PC: 12aa2 | Set disk transfer address |
| 2018-12-25T11:50:02.559509178Z | 78 | PC: 12bca | Find first file (See above) |
| 2018-12-25T11:50:02.566576194Z | 61 | PC: 12bca | Open file (See above) |
| 2018-12-25T11:50:02.575384273Z | 63 | PC: 12bca | Read file or device (See above) |
| 2018-12-25T11:50:02.584501964Z | 64 | PC: 12bca | Write file or device (See above) |
| 2018-12-25T11:50:02.602313179Z | 64 | PC: 12bca | Write file or device (See above) |
| 2018-12-25T11:50:02.611880102Z | 62 | PC: 12bca | Close file (See above) |
| 2018-12-25T11:50:02.622138085Z | 59 | PC: 12b19 | Change current directory |
| 2018-12-25T11:50:02.625436043Z | 26 | PC: 12b20 | Set disk transfer address |
| 2018-12-25T11:50:02.62699223Z | 37 | PC: 12bca | Set interrupt vector (See above) |
| 2018-12-25T11:50:02.628949957Z | 42 | PC: 12b32 | Get date 0x12b32: cmp dx, 0x701 0x12b36: jne 0x12b40 0x12b38: mov ah, 9 0x12b3a: lea dx, word ptr [si + 0x2e8] 0x12b3e: int 0x21 0x12b40: push 0x100 0x12b43: ret 0x12b44: mov ax, word ptr es:[di + 0x11] 0x12b48: mov word ptr es:[di + 0x15], ax 0x12b4c: sub ax, 3 0x12b4f: mov word ptr [si + 0x2e5], ax 0x12b53: mov ah, 0x40 0x12b55: mov cx, 0x22d 0x12b58: lea dx, word ptr [si + 0x104] 0x12b5c: call 0x12bc3 0x12b5f: mov word ptr es:[di + 0x15], 0 0x12b65: mov ah, 0x40 0x12b67: mov cx, 4 0x12b6a: lea dx, word ptr [si + 0x2e4] 0x12b6e: call 0x12bc3 |
| 2018-12-25T11:50:02.631995122Z | 9 | PC: 12b40 | Display string (String= 'This is Weeding Party 1.0 virus by Dark Judge in Tainan, Taiwan |