Sample viewer

vx.netlux.org/Virus.DOS.Grapje.1039

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T21:53:42.603822897Z 71 PC: 12c51 | Get current directory
2018-12-17T21:53:42.607120404Z 26 PC: 12b78 | Set disk transfer address
2018-12-17T21:53:42.608241629Z 78 PC: 12cf3 | Find first file
2018-12-17T21:53:42.613974363Z 61 PC: 12d26 | Open file (Filename = 'SLEEP.COM')
2018-12-17T21:53:42.620927137Z 63 PC: 12d44 | Read file or device (Read 5 bytes on handle 5)
2018-12-17T21:53:42.627288874Z 87 PC: 12c0f | Get or set file date and time
2018-12-17T21:53:42.628604603Z 42 PC: 12b83 | Get date 0x12b83: mov byte ptr [0x219], dl
0x12b87: mov byte ptr [0x21a], dh
0x12b8b: mov word ptr [0x21b], cx
0x12b8f: pop dx
0x12b90: pop cx
0x12b91: pop bx
0x12b92: pop ax
0x12b93: ret
0x12b94: push ax
0x12b95: push bx
0x12b96: push dx
0x12b97: xor cx, cx
0x12b99: mov ax, word ptr [0x21f]
0x12b9c: sub ax, 0x7c6
0x12b9f: mov bx, 0x16d
0x12ba2: xor dx, dx
0x12ba4: mul bx
0x12ba6: mov cx, ax
0x12ba8: xor ah, ah
0x12baa: mov al, byte ptr [0x21e]
2018-12-17T21:53:42.630871508Z 66 PC: 12c79 | Move file pointer
2018-12-17T21:53:42.632319588Z 63 PC: 12d84 | Read file or device (Read 1012 bytes on handle 5)
2018-12-17T21:53:42.634597747Z 66 PC: 12d9b | Move file pointer
2018-12-17T21:53:42.636158129Z 64 PC: 12dbf | Write file or device (Write 1012 bytes on handle 5)
2018-12-17T21:53:42.650961717Z 66 PC: 12dd6 | Move file pointer
2018-12-17T21:53:42.652391896Z 64 PC: 12dec | Write file or device (Write 27 bytes on handle 5)
2018-12-17T21:53:42.65510349Z 66 PC: 12e1c | Move file pointer
2018-12-17T21:53:42.657565857Z 64 PC: 12e2f | Write file or device (Write 1012 bytes on handle 5)
2018-12-17T21:53:42.666034835Z 62 PC: 12e07 | Close file
2018-12-17T21:53:42.674484912Z 42 PC: 12bdf | Get date 0x12bdf: mov byte ptr [0x21d], dl
0x12be3: mov byte ptr [0x21e], dh
0x12be7: mov word ptr [0x21f], cx
0x12beb: call 0x22b94
0x12bee: pop ax
0x12bef: sub cx, ax
0x12bf1: cmp cx, 0x1e
0x12bf4: ja 0x12bfc
0x12bf6: clc
0x12bf7: pop dx
0x12bf8: pop cx
0x12bf9: pop bx
0x12bfa: pop ax
0x12bfb: ret
0x12bfc: stc
0x12bfd: pop dx
0x12bfe: pop cx
0x12bff: pop bx
0x12c00: pop ax
0x12c01: ret
2018-12-17T21:53:42.686674481Z 59 PC: 12c62 | Change current directory
2018-12-17T21:53:42.690759193Z 61 PC: 12d26 | Open file (Filename = 'SLEEP.COM')
2018-12-17T21:53:42.697350717Z 87 PC: 12c31 | Get or set file date and time
2018-12-17T21:53:42.699489813Z 62 PC: 12e07 | Close file
2018-12-17T21:53:42.710882814Z 76 PC: 0 | Terminate with return code (Return code = '0')