Sample viewer

vx.netlux.org/Virus.DOS.Vienna.1032

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:28:25.702127982Z 48 PC: 12ba5 | Get DOS version
2018-12-17T22:28:25.704375617Z 53 PC: 12bb1 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:28:25.705631104Z 37 PC: 12bc4 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:28:25.70699302Z 47 PC: 12c8c | Get disk transfer address
2018-12-17T22:28:25.708431435Z 26 PC: 12c9e | Set disk transfer address
2018-12-17T22:28:25.709607453Z 78 PC: 12cf8 | Find first file
2018-12-17T22:28:25.716001716Z 48 PC: 12d15 | Get DOS version
2018-12-17T22:28:25.717380555Z 61 PC: 12d38 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:28:25.725109499Z 66 PC: 12d4e | Move file pointer
2018-12-17T22:28:25.72633155Z 63 PC: 12d5a | Read file or device (Read 6 bytes on handle 5)
2018-12-17T22:28:25.730566418Z 62 PC: 12d63 | Close file
2018-12-17T22:28:25.733531582Z 67 PC: 12d85 | Get or set file attributes
2018-12-17T22:28:25.739860244Z 67 PC: 12d96 | Get or set file attributes
2018-12-17T22:28:25.758557126Z 61 PC: 12da6 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:28:25.78103707Z 66 PC: 12db8 | Move file pointer
2018-12-17T22:28:25.783037225Z 87 PC: 12dbd | Get or set file date and time
2018-12-17T22:28:25.785057Z 63 PC: 12dd1 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:28:25.794317625Z 66 PC: 12e01 | Move file pointer
2018-12-17T22:28:25.79646979Z 64 PC: 12e2b | Write file or device (Write 1032 bytes on handle 5)
2018-12-17T22:28:25.806071662Z 66 PC: 12e3b | Move file pointer
2018-12-17T22:28:25.808338196Z 64 PC: 12e48 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:28:25.815831985Z 87 PC: 12e55 | Get or set file date and time
2018-12-17T22:28:25.817483833Z 67 PC: 12e63 | Get or set file attributes
2018-12-17T22:28:25.829661425Z 26 PC: 12e70 | Set disk transfer address
2018-12-17T22:28:25.831490541Z 62 PC: 12e75 | Close file
2018-12-17T22:28:25.837402375Z 37 PC: 12e83 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:28:25.844326182Z 9 PC: 12a82 | Display string (String= 'Goat file (COM). Size=0000014Dh/0000000333d bytes. ')
2018-12-17T22:28:25.848459849Z 76 PC: 12a86 | Terminate with return code (Return code = '36')