Sample viewer

vx.netlux.org/Trojan.DOS.Direxe.c

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:26:58.934625453Z 53 PC: 137da | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:26:58.936721498Z 53 PC: 137da | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:26:58.938813371Z 53 PC: 137da | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:26:58.940241596Z 53 PC: 137da | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:26:58.941743975Z 53 PC: 137da | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:26:58.95974577Z 53 PC: 137da | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:26:58.961264495Z 53 PC: 137da | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:26:58.96275397Z 53 PC: 137da | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:26:58.969254447Z 53 PC: 137da | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:26:58.970832307Z 53 PC: 137da | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:26:58.971919946Z 53 PC: 137da | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:26:58.973786891Z 53 PC: 137da | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:26:58.975020083Z 53 PC: 137da | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:26:58.976221175Z 53 PC: 137da | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:26:58.978211757Z 53 PC: 137da | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:26:58.97937237Z 53 PC: 137da | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:26:58.980500004Z 53 PC: 137da | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:26:58.98243531Z 53 PC: 137da | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:26:58.984028311Z 53 PC: 137da | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:26:58.985571361Z 37 PC: 137ef | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:26:58.987543403Z 37 PC: 137f7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:26:58.988870826Z 37 PC: 137ff | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:26:58.990247826Z 37 PC: 13807 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:26:58.992643168Z 68 PC: 14081 | I/O control for devices (Set for = 'QWG')
2018-12-17T22:26:59.017366333Z 37 PC: 13201 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:26:59.01904466Z 42 PC: 12f67 | Get date 0x12f67: xor ah, ah
0x12f69: les di, ptr [bp + 6]
0x12f6c: stosw word ptr es:[di], ax
0x12f6d: mov al, dl
0x12f6f: les di, ptr [bp + 0xa]
0x12f72: stosw word ptr es:[di], ax
0x12f73: mov al, dh
0x12f75: les di, ptr [bp + 0xe]
0x12f78: stosw word ptr es:[di], ax
0x12f79: xchg ax, cx
0x12f7a: les di, ptr [bp + 0x12]
0x12f7d: stosw word ptr es:[di], ax
0x12f7e: pop bp
0x12f7f: retf 0x10
0x12f82: push bp
0x12f83: mov bp, sp
0x12f85: mov cx, word ptr [bp + 0xa]
0x12f88: mov dh, byte ptr [bp + 8]
0x12f8b: mov dl, byte ptr [bp + 6]
0x12f8e: mov ah, 0x2b
2018-12-17T22:26:59.029203605Z 53 PC: 1312f | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:26:59.030799578Z 37 PC: 13138 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:26:59.031901448Z 53 PC: 1312f | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:26:59.033201966Z 37 PC: 13138 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:26:59.03460334Z 53 PC: 1312f | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:26:59.03568916Z 37 PC: 13138 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:26:59.036927765Z 53 PC: 1312f | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:26:59.03858451Z 37 PC: 13138 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:26:59.039678954Z 53 PC: 1312f | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:26:59.040962469Z 37 PC: 13138 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:26:59.04285966Z 53 PC: 1312f | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:26:59.044035208Z 37 PC: 13138 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:26:59.045157822Z 53 PC: 1312f | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:26:59.047264227Z 37 PC: 13138 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:26:59.048634827Z 53 PC: 1312f | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:26:59.050102059Z 37 PC: 13138 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:26:59.052086216Z 53 PC: 1312f | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:26:59.053488516Z 37 PC: 13138 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:26:59.054836891Z 53 PC: 1312f | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:26:59.057499442Z 37 PC: 13138 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:26:59.05892165Z 53 PC: 1312f | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:26:59.06045164Z 37 PC: 13138 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:26:59.062507543Z 53 PC: 1312f | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:26:59.063733102Z 37 PC: 13138 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:26:59.064852584Z 53 PC: 1312f | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:26:59.066873815Z 37 PC: 13138 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:26:59.067953454Z 53 PC: 1312f | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:26:59.069062651Z 37 PC: 13138 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:26:59.071011764Z 53 PC: 1312f | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:26:59.072337925Z 37 PC: 13138 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:26:59.074197226Z 53 PC: 1312f | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:26:59.076155013Z 37 PC: 13138 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:26:59.077528408Z 53 PC: 1312f | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:26:59.078868504Z 37 PC: 13138 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:26:59.080695695Z 53 PC: 1312f | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:26:59.081976293Z 37 PC: 13138 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:26:59.083180105Z 53 PC: 1312f | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:26:59.08481011Z 37 PC: 13138 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:26:59.086351177Z 41 PC: 130e6 | Parse filename
2018-12-17T22:26:59.088099424Z 41 PC: 130f4 | Parse filename
2018-12-17T22:26:59.090995252Z 75 PC: 130ff | Execute program
2018-12-17T22:26:59.113154793Z 80 PC: 18569 | Set current PSP
2018-12-17T22:26:59.114397973Z 48 PC: 1856e | Get DOS version
2018-12-17T22:26:59.116473538Z 99 PC: 1ed50 | Get DBCS lead byte table pointer
2018-12-17T22:26:59.120071607Z 101 PC: 185f4 | Get extended country info
2018-12-17T22:26:59.121678352Z 99 PC: 185fa | Get DBCS lead byte table pointer
2018-12-17T22:26:59.12323403Z 74 PC: 1865c | Reallocate memory
2018-12-17T22:26:59.125012305Z 25 PC: 18693 | Get default drive
2018-12-17T22:26:59.12622284Z 37 PC: 18153 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T22:26:59.127885042Z 37 PC: 1815a | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:26:59.129750646Z 37 PC: 18161 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:26:59.134555911Z 74 PC: 172fc | Reallocate memory
2018-12-17T22:26:59.136401321Z 72 PC: 1733d | Allocate memory
2018-12-17T22:26:59.139436197Z 72 PC: 17375 | Allocate memory
2018-12-17T22:26:59.141265512Z 72 PC: 1737d | Allocate memory