Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Jackie.6304

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:25:22.260855719Z 53 PC: 131ca | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:25:22.262781019Z 53 PC: 131ca | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:25:22.264408989Z 53 PC: 131ca | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:25:22.265839796Z 53 PC: 131ca | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:25:22.267798656Z 53 PC: 131ca | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:25:22.270821646Z 53 PC: 131ca | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:25:22.272274196Z 53 PC: 131ca | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:25:22.27415699Z 53 PC: 131ca | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:25:22.27533612Z 53 PC: 131ca | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:25:22.276795289Z 53 PC: 131ca | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:25:22.278428453Z 53 PC: 131ca | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:25:22.280101811Z 53 PC: 131ca | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:25:22.281194104Z 53 PC: 131ca | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:25:22.2822631Z 53 PC: 131ca | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:25:22.284213992Z 53 PC: 131ca | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:25:22.285325217Z 53 PC: 131ca | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:25:22.28670083Z 53 PC: 131ca | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:25:22.288832833Z 53 PC: 131ca | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:25:22.290091688Z 53 PC: 131ca | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:25:22.29142756Z 37 PC: 131df | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:25:22.294190853Z 37 PC: 131e7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:25:22.295502826Z 37 PC: 131ef | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:25:22.296786827Z 37 PC: 131f7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:25:22.299268174Z 68 PC: 13f22 | I/O control for devices (Set for = '')
2018-12-17T22:25:22.300698825Z 44 PC: 14059 | Get time 0x14059: mov word ptr [0x62], cx
0x1405d: mov word ptr [0x64], dx
0x14061: retf
0x14062: call 0x140a9
0x14065: jb 0x14076
0x14067: mov cx, word ptr es:[di + 4]
0x1406b: cmp cx, 1
0x1406e: je 0x14076
0x14070: xor bx, bx
0x14072: push cs
0x14073: call 0x23bea
0x14076: retf 4
0x14079: call 0x140a9
0x1407c: jb 0x14091
0x1407e: mov ax, cx
0x14080: mov dx, bx
0x14082: mov cx, word ptr es:[di + 4]
0x14086: cmp cx, 1
0x14089: je 0x14091
0x1408b: xor bx, bx
2018-12-17T22:25:22.302660569Z 48 PC: 13a52 | Get DOS version
2018-12-17T22:25:22.305581958Z 67 PC: 12fa1 | Get or set file attributes
2018-12-17T22:25:22.31133249Z 67 PC: 12fc8 | Get or set file attributes
2018-12-17T22:25:22.328240799Z 61 PC: 13890 | Open file (Filename = 'TEST.EXE')
2018-12-17T22:25:22.339749739Z 63 PC: 13963 | Read file or device (Read 6304 bytes on handle 5)
2018-12-17T22:25:22.348047261Z 66 PC: 140c3 | Move file pointer
2018-12-17T22:25:22.349344734Z 66 PC: 140d1 | Move file pointer
2018-12-17T22:25:22.350667897Z 66 PC: 140df | Move file pointer
2018-12-17T22:25:22.353323316Z 26 PC: 1303f | Set disk transfer address
2018-12-17T22:25:22.354457634Z 78 PC: 1304b | Find first file
2018-12-17T22:25:22.360446709Z 26 PC: 13063 | Set disk transfer address
2018-12-17T22:25:22.362781387Z 79 PC: 13068 | Find next file
2018-12-17T22:25:22.365078711Z 42 PC: 12f27 | Get date 0x12f27: xor ah, ah
0x12f29: les di, ptr [bp + 6]
0x12f2c: stosw word ptr es:[di], ax
0x12f2d: mov al, dl
0x12f2f: les di, ptr [bp + 0xa]
0x12f32: stosw word ptr es:[di], ax
0x12f33: mov al, dh
0x12f35: les di, ptr [bp + 0xe]
0x12f38: stosw word ptr es:[di], ax
0x12f39: xchg ax, cx
0x12f3a: les di, ptr [bp + 0x12]
0x12f3d: stosw word ptr es:[di], ax
0x12f3e: pop bp
0x12f3f: retf 0x10
0x12f42: push bp
0x12f43: mov bp, sp
0x12f45: mov cx, word ptr [bp + 0xa]
0x12f48: mov dh, byte ptr [bp + 8]
0x12f4b: mov dl, byte ptr [bp + 6]
0x12f4e: mov ah, 0x2b
2018-12-17T22:25:22.367472353Z 64 PC: 135e8 | Write file or device (Write 0 bytes on handle 1)
2018-12-17T22:25:22.370305625Z 37 PC: 13321 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:25:22.37187912Z 37 PC: 13321 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:25:22.372984428Z 37 PC: 13321 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:25:22.381166045Z 37 PC: 13321 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:25:22.382458128Z 37 PC: 13321 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:25:22.384094414Z 37 PC: 13321 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:25:22.386624974Z 37 PC: 13321 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:25:22.387624844Z 37 PC: 13321 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:25:22.388811857Z 37 PC: 13321 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:25:22.390794433Z 37 PC: 13321 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:25:22.392176346Z 37 PC: 13321 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:25:22.393766889Z 37 PC: 13321 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:25:22.395848284Z 37 PC: 13321 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:25:22.397009884Z 37 PC: 13321 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:25:22.398147094Z 37 PC: 13321 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:25:22.399467129Z 37 PC: 13321 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:25:22.400843992Z 37 PC: 13321 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:25:22.401946322Z 37 PC: 13321 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:25:22.403385798Z 37 PC: 13321 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:25:22.405356249Z 76 PC: 13360 | Terminate with return code (Return code = '0')