Sample viewer

vx.netlux.org/Virus.DOS.Jerusalem.SP_VI.1653

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:25:06.353544153Z 240 PC: 12ad9 | UNKNOWN!
2018-12-17T22:25:06.355212029Z 240 PC: 12b04 | UNKNOWN!
2018-12-17T22:25:06.356913123Z 74 PC: 12b88 | Reallocate memory
2018-12-17T22:25:06.358873472Z 53 PC: 12b8d | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:25:06.36089077Z 37 PC: 12ba1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:25:06.363899335Z 44 PC: 12bd8 | Get time 0x12bd8: cmp ch, 0x16
0x12bdb: jne 0x12c0d
0x12bdd: mov ah, 0x19
0x12bdf: int 0x21
0x12be1: mov dl, al
0x12be3: cmp dl, 2
0x12be6: jb 0x12beb
0x12be8: add dl, 0x7e
0x12beb: mov ax, 0x50f
0x12bee: xor cx, cx
0x12bf0: inc cl
0x12bf2: xor dh, dh
0x12bf4: lea bx, word ptr [0x1bc]
0x12bf8: int 0x13
0x12bfa: int 0x19
0x12bfc: add byte ptr [bx + si], al
0x12bfe: add word ptr [bp + si], ax
0x12c00: nop
0x12c01: nop
0x12c02: nop
2018-12-17T22:25:06.36672801Z 75 PC: 12c19 | Execute program
2018-12-17T22:25:06.382845962Z 9 PC: 132a7 | Display string (String= 'This file is infected with the Curse.B VIRUS!')
2018-12-17T22:25:06.388072788Z 73 PC: 12c1f | Release memory
2018-12-17T22:25:06.389699949Z 77 PC: 12c23 | Get program return code
2018-12-17T22:25:06.391196066Z 49 PC: 12c31 | Terminate and stay resident (Return code = '0' | Memory size = '119')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":4436,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:51:51.526183835Z 240 PC: 12ad9 | UNKNOWN!
2018-12-25T11:51:51.539716683Z 240 PC: 12b04 | UNKNOWN!
2018-12-25T11:51:51.541131374Z 74 PC: 12b88 | Reallocate memory
2018-12-25T11:51:51.54282177Z 53 PC: 12b8d | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T11:51:51.545332766Z 37 PC: 12ba1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T11:51:51.547046272Z 44 PC: 12bd8 | Get time 0x12bd8: cmp ch, 0x16
0x12bdb: jne 0x12c0d
0x12bdd: mov ah, 0x19
0x12bdf: int 0x21
0x12be1: mov dl, al
0x12be3: cmp dl, 2
0x12be6: jb 0x12beb
0x12be8: add dl, 0x7e
0x12beb: mov ax, 0x50f
0x12bee: xor cx, cx
0x12bf0: inc cl
0x12bf2: xor dh, dh
0x12bf4: lea bx, word ptr [0x1bc]
0x12bf8: int 0x13
0x12bfa: int 0x19
0x12bfc: add byte ptr [bx + si], al
0x12bfe: add word ptr [bp + si], ax
0x12c00: nop
0x12c01: nop
0x12c02: nop
2018-12-25T11:51:51.549447789Z 75 PC: 12c19 | Execute program
2018-12-25T11:51:51.565035315Z 9 PC: 132a7 | Display string (String= 'This file is infected with the Curse.B VIRUS!')
2018-12-25T11:51:51.569187558Z 73 PC: 12c1f | Release memory
2018-12-25T11:51:51.570484692Z 77 PC: 12c23 | Get program return code
2018-12-25T11:51:51.571646508Z 49 PC: 12c31 | Terminate and stay resident (Return code = '0' | Memory size = '119')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":22,"Min":0,"Second":0,"TimeBased":true,"OriginalID":4436,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:51:51.686958183Z 240 PC: 12ad9 | UNKNOWN!
2018-12-25T11:51:51.688853365Z 240 PC: 12b04 | UNKNOWN!
2018-12-25T11:51:51.690101083Z 74 PC: 12b88 | Reallocate memory
2018-12-25T11:51:51.691547003Z 53 PC: 12b8d | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T11:51:51.693107693Z 37 PC: 12ba1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T11:51:51.695157645Z 44 PC: 12bd8 | Get time 0x12bd8: cmp ch, 0x16
0x12bdb: jne 0x12c0d
0x12bdd: mov ah, 0x19
0x12bdf: int 0x21
0x12be1: mov dl, al
0x12be3: cmp dl, 2
0x12be6: jb 0x12beb
0x12be8: add dl, 0x7e
0x12beb: mov ax, 0x50f
0x12bee: xor cx, cx
0x12bf0: inc cl
0x12bf2: xor dh, dh
0x12bf4: lea bx, word ptr [0x1bc]
0x12bf8: int 0x13
0x12bfa: int 0x19
0x12bfc: add byte ptr [bx + si], al
0x12bfe: add word ptr [bp + si], ax
0x12c00: nop
0x12c01: nop
0x12c02: nop
2018-12-25T11:51:51.698275326Z 25 PC: 12be1 | Get default drive
2018-12-25T11:51:53.769486328Z 72 PC: 8f1b9 | Allocate memory
2018-12-25T11:51:53.771383319Z 72 PC: 8f1bd | Allocate memory
2018-12-25T11:51:53.773396958Z 99 PC: 90858 | Get DBCS lead byte table pointer
2018-12-25T11:51:53.776076452Z 61 PC: 91f88 | Open file (Filename = 'C:\WINDOWS\HIMEM.SYS')
2018-12-25T11:51:53.786838045Z 66 PC: 91f95 | Move file pointer
2018-12-25T11:51:53.788579112Z 62 PC: 91fc1 | Close file
2018-12-25T11:51:53.790940028Z 75 PC: 91fe0 | Execute program
2018-12-25T11:51:53.807006628Z 98 PC: 916f1 | Get current PSP
2018-12-25T11:51:53.808166887Z 9 PC: c605 | Display string (String= '6r&;] u')
2018-12-25T11:51:53.817203502Z 48 PC: c609 | Get DOS version
2018-12-25T11:51:53.820909637Z 9 PC: c382 | Display string (String= ' Installed A20 handler number ')
2018-12-25T11:51:53.824803053Z 2 PC: c38c | Character output (Char = '32')
2018-12-25T11:51:53.826954166Z 2 PC: c3a7 | Character output (Char = '2e')
2018-12-25T11:51:53.831369647Z 9 PC: c6d9 | Display string (String= 'VHVD[email protected]_Kut1Dt a1ZW 5|(Nj(p^')
2018-12-25T11:51:53.837098956Z 9 PC: c6e0 | Display string (String= '5|(Nj(p^')
2018-12-25T11:51:53.846652843Z 61 PC: 91f88 | Open file (See above)
2018-12-25T11:51:53.857690021Z 66 PC: 91f95 | Move file pointer (See above)
2018-12-25T11:51:53.859416972Z 62 PC: 91fc1 | Close file (See above)
2018-12-25T11:51:53.861826421Z 75 PC: 91fe0 | Execute program (See above)
2018-12-25T11:51:53.883741094Z 98 PC: 916f1 | Get current PSP (See above)
2018-12-25T11:51:53.887668895Z 82 PC: 13d46 | Get DOS internal pointers (SYSVARS)
2018-12-25T11:51:53.889308774Z 53 PC: 13ac3 | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T11:51:53.891641904Z 37 PC: 13ad6 | Set interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T11:51:53.893152162Z 53 PC: 13ae0 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T11:51:53.894735807Z 37 PC: 13af3 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T11:51:53.896809667Z 9 PC: 13a0d | Display string (Could not find end pointer)
2018-12-25T11:51:53.908282215Z 62 PC: 8f8eb | Close file
2018-12-25T11:51:53.909963704Z 62 PC: 8f8f2 | Close file
2018-12-25T11:51:53.911629364Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.921331178Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.922730695Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.924062851Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.925818702Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.927144296Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.928398545Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.930193851Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.931549571Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.932957025Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.93540273Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.937375549Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.938959661Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.942140863Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.943562344Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.944866077Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.946497166Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.947939708Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.949229039Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.951437143Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.952873841Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.954228927Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.955821627Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.957320162Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.958904418Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.961121064Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.962418452Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.963656621Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.97354418Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:51:53.974846595Z 61 PC: 8f8ff | Open file (Filename = '')
2018-12-25T11:51:53.979506359Z 62 PC: 8f90e | Close file
2018-12-25T11:51:53.981538343Z 69 PC: 8f915 | Duplicate handle
2018-12-25T11:51:53.982781172Z 69 PC: 8f919 | Duplicate handle
2018-12-25T11:51:53.983936778Z 61 PC: 9387b | Open file (Filename = '')
2018-12-25T11:51:53.995033942Z 68 PC: 9386b | I/O control for devices (Set for = '')
2018-12-25T11:51:54.00375834Z 61 PC: 9387b | Open file (See above)
2018-12-25T11:51:54.00700089Z 68 PC: 9386b | I/O control for devices (See above)
2018-12-25T11:51:54.008830326Z 74 PC: 8f9c4 | Reallocate memory
2018-12-25T11:51:54.010130381Z 72 PC: 8f9e0 | Allocate memory
2018-12-25T11:51:54.011343636Z 72 PC: 8f9e4 | Allocate memory
2018-12-25T11:51:54.012546247Z 74 PC: 8f9fb | Reallocate memory
2018-12-25T11:51:54.014301853Z 72 PC: 8fa02 | Allocate memory
2018-12-25T11:51:54.0158697Z 72 PC: 8fa06 | Allocate memory
2018-12-25T11:51:54.017467917Z 73 PC: 8fa11 | Release memory
2018-12-25T11:51:54.019040967Z 73 PC: 8efea | Release memory
2018-12-25T11:51:54.020342249Z 74 PC: 8f003 | Reallocate memory
2018-12-25T11:51:54.022008628Z 72 PC: 8f054 | Allocate memory
2018-12-25T11:51:54.023257734Z 72 PC: 8f058 | Allocate memory
2018-12-25T11:51:54.024361242Z 73 PC: 8f060 | Release memory
2018-12-25T11:51:54.02539064Z 61 PC: 8f080 | Open file (Filename = 'r,S[
2018-12-25T11:51:54.034308405Z 63 PC: 8f095 | Read file or device (Read 4 bytes on handle 5)
2018-12-25T11:51:54.039446788Z 66 PC: 8f0ad | Move file pointer
2018-12-25T11:51:54.040690951Z 62 PC: 8f0d1 | Close file
2018-12-25T11:51:54.042633671Z 75 PC: 8f0f2 | Execute program
2018-12-25T11:51:54.060938272Z 80 PC: 12be9 | Set current PSP
2018-12-25T11:51:54.061891837Z 48 PC: 12bee | Get DOS version
2018-12-25T11:51:54.063199193Z 99 PC: 193d0 | Get DBCS lead byte table pointer
2018-12-25T11:51:54.064715237Z 101 PC: 12c74 | Get extended country info
2018-12-25T11:51:54.065707035Z 99 PC: 12c7a | Get DBCS lead byte table pointer
2018-12-25T11:51:54.066827363Z 74 PC: 12cdc | Reallocate memory
2018-12-25T11:51:54.067932649Z 72 PC: 1355d | Allocate memory
2018-12-25T11:51:54.069545148Z 25 PC: 13596 | Get default drive
2018-12-25T11:51:54.070621028Z 71 PC: 135ad | Get current directory
2018-12-25T11:51:54.072731412Z 59 PC: 135ba | Change current directory
2018-12-25T11:51:54.07770351Z 59 PC: 135c8 | Change current directory
2018-12-25T11:51:54.082270925Z 59 PC: 135d3 | Change current directory
2018-12-25T11:51:54.085789165Z 25 PC: 12d13 | Get default drive
2018-12-25T11:51:54.087397947Z 37 PC: 127d3 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T11:51:54.088861221Z 37 PC: 127da | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T11:51:54.090153926Z 37 PC: 127e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:51:54.092465994Z 80 PC: 1301d | Set current PSP
2018-12-25T11:51:54.093551289Z 37 PC: 13041 | Set interrupt vector (Interrupt = '46' AKA 'Set verify flag')
2018-12-25T11:51:54.094915642Z 53 PC: 13362 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T11:51:54.096387007Z 37 PC: 13383 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T11:51:54.097886337Z 51 PC: 13417 | Get or set Ctrl-Break
2018-12-25T11:51:54.100104069Z 72 PC: 130ec | Allocate memory
2018-12-25T11:51:54.102142153Z 61 PC: 131b2 | Open file (Filename = '')
2018-12-25T11:51:54.108216717Z 62 PC: 131ba | Close file
2018-12-25T11:51:54.110280054Z 51 PC: 1344c | Get or set Ctrl-Break
2018-12-25T11:51:54.111519548Z 74 PC: 1197c | Reallocate memory
2018-12-25T11:51:54.113817313Z 72 PC: 11991 | Allocate memory
2018-12-25T11:51:54.116618918Z 73 PC: 119b2 | Release memory
2018-12-25T11:51:54.11870901Z 72 PC: 119bd | Allocate memory
2018-12-25T11:51:54.120542956Z 73 PC: 119df | Release memory
2018-12-25T11:51:54.121996951Z 72 PC: 119f5 | Allocate memory
2018-12-25T11:51:54.124265035Z 72 PC: 119fd | Allocate memory