Sample viewer

vx.netlux.org/Virus.DOS.Vienna.1289

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-17T21:55:04.422654966Z	42	PC: 12c4f \| Get date 0x12c4f: cmp al, 0 0x12c51: jne 0x12c56 0x12c53: jmp 0x13075 0x12c56: mov dx, 0x2c 0x12c59: add dx, di 0x12c5b: mov bx, dx 0x12c5d: mov ah, 0x1a 0x12c5f: int 0x21 0x12c61: mov bp, 0 0x12c64: mov dx, di 0x12c66: add dx, 7 0x12c69: nop 0x12c6a: mov cx, 3 0x12c6d: mov ah, 0x4e 0x12c6f: int 0x21 0x12c71: jmp 0x12c78 0x12c73: nop 0x12c74: mov ah, 0x4f 0x12c76: int 0x21 0x12c78: jae 0x12c8f
2018-12-17T21:55:04.425731918Z	26	PC: 12c61 \| Set disk transfer address
2018-12-17T21:55:04.426728187Z	78	PC: 12c71 \| Find first file
2018-12-17T21:55:04.432989698Z	67	PC: 12cce \| Get or set file attributes
2018-12-17T21:55:04.439022397Z	67	PC: 12ce1 \| Get or set file attributes
2018-12-17T21:55:04.458033257Z	61	PC: 12cec \| Open file (Filename = 'SLEEP.COM')
2018-12-17T21:55:04.470258086Z	87	PC: 12cf8 \| Get or set file date and time
2018-12-17T21:55:04.478227031Z	63	PC: 12d0d \| Read file or device (Read 3 bytes on handle 5)
2018-12-17T21:55:04.484464227Z	66	PC: 12d21 \| Move file pointer
2018-12-17T21:55:04.485879457Z	64	PC: 12d49 \| Write file or device (Write 1289 bytes on handle 5)
2018-12-17T21:55:04.4943277Z	66	PC: 12d5d \| Move file pointer
2018-12-17T21:55:04.495983355Z	64	PC: 12d6c \| Write file or device (Write 3 bytes on handle 5)
2018-12-17T21:55:04.50267212Z	87	PC: 12d81 \| Get or set file date and time
2018-12-17T21:55:04.504331887Z	62	PC: 12d85 \| Close file
2018-12-17T21:55:04.512677182Z	67	PC: 12d8e \| Get or set file attributes
2018-12-17T21:55:04.516779778Z	26	PC: 12d95 \| Set disk transfer address

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":546,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T11:41:19.689792242Z	42	PC: 12c4f \| Get date 0x12c4f: cmp al, 0 0x12c51: jne 0x12c56 0x12c53: jmp 0x13075 0x12c56: mov dx, 0x2c 0x12c59: add dx, di 0x12c5b: mov bx, dx 0x12c5d: mov ah, 0x1a 0x12c5f: int 0x21 0x12c61: mov bp, 0 0x12c64: mov dx, di 0x12c66: add dx, 7 0x12c69: nop 0x12c6a: mov cx, 3 0x12c6d: mov ah, 0x4e 0x12c6f: int 0x21 0x12c71: jmp 0x12c78 0x12c73: nop 0x12c74: mov ah, 0x4f 0x12c76: int 0x21 0x12c78: jae 0x12c8f
2018-12-25T11:41:19.692739156Z	26	PC: 12c61 \| Set disk transfer address
2018-12-25T11:41:19.69413365Z	78	PC: 12c71 \| Find first file
2018-12-25T11:41:19.700394378Z	67	PC: 12cce \| Get or set file attributes
2018-12-25T11:41:19.706654108Z	67	PC: 12ce1 \| Get or set file attributes
2018-12-25T11:41:19.721994918Z	61	PC: 12cec \| Open file (Filename = 'SLEEP.COM')
2018-12-25T11:41:19.728398696Z	87	PC: 12cf8 \| Get or set file date and time
2018-12-25T11:41:19.729902681Z	63	PC: 12d0d \| Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:41:19.736309719Z	66	PC: 12d21 \| Move file pointer
2018-12-25T11:41:19.73773305Z	64	PC: 12d49 \| Write file or device (Write 1289 bytes on handle 5)
2018-12-25T11:41:19.746397504Z	66	PC: 12d5d \| Move file pointer
2018-12-25T11:41:19.750064749Z	64	PC: 12d6c \| Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:41:19.756679284Z	87	PC: 12d81 \| Get or set file date and time
2018-12-25T11:41:19.75850664Z	62	PC: 12d85 \| Close file
2018-12-25T11:41:19.767019223Z	67	PC: 12d8e \| Get or set file attributes
2018-12-25T11:41:19.771417458Z	26	PC: 12d95 \| Set disk transfer address

{"DateBased":true,"Day":6,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":546,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T11:41:19.822895833Z	42	PC: 12c4f \| Get date 0x12c4f: cmp al, 0 0x12c51: jne 0x12c56 0x12c53: jmp 0x13075 0x12c56: mov dx, 0x2c 0x12c59: add dx, di 0x12c5b: mov bx, dx 0x12c5d: mov ah, 0x1a 0x12c5f: int 0x21 0x12c61: mov bp, 0 0x12c64: mov dx, di 0x12c66: add dx, 7 0x12c69: nop 0x12c6a: mov cx, 3 0x12c6d: mov ah, 0x4e 0x12c6f: int 0x21 0x12c71: jmp 0x12c78 0x12c73: nop 0x12c74: mov ah, 0x4f 0x12c76: int 0x21 0x12c78: jae 0x12c8f
2018-12-25T11:41:19.827501307Z	9	PC: 1309f \| Display string (String= ' �� ')
2018-12-25T11:41:19.831903787Z	9	PC: 1309f \| Display string (See above)
2018-12-25T11:41:19.837691864Z	9	PC: 1309f \| Display string (See above)
2018-12-25T11:41:19.842779082Z	9	PC: 1309f \| Display string (See above)