Sample viewer

vx.netlux.org/Virus.DOS.AntiFort.1493

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:25:23.017664715Z 84 PC: 1432a | Get verify flag
2018-12-17T22:25:23.019801375Z 82 PC: 14333 | Get DOS internal pointers (SYSVARS)
2018-12-17T22:25:23.022927364Z 53 PC: 142cd | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:25:23.024348837Z 37 PC: 142e0 | Set interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:25:23.026500147Z 48 PC: 12a63 | Get DOS version
2018-12-17T22:25:23.027966989Z 9 PC: 12a7a | Display string (String= ' --=[ Selfchecking AntiStealth Goat COM/EXE file, 01/06/01 ]=------------------ (c) 1995-2001 by ROSE SWE, Dipl.-Ing. Ralph Roth - Version 1.18 - Freeware ')
2018-12-17T22:25:23.037258492Z 61 PC: 12cb7 | Open file (Filename = '')
2018-12-17T22:25:23.044458849Z 9 PC: 12a88 | Display string (String= 'Self test: ')
2018-12-17T22:25:23.047521045Z 93 PC: 12b24 | File sharing functions
2018-12-17T22:25:23.050226767Z 9 PC: 12b03 | Display string (String= 'Size change=+05E0h/01504d. Virus might be activ? ')
2018-12-17T22:25:23.055905616Z 76 PC: 12b09 | Terminate with return code (Return code = '1')