Sample viewer

vx.netlux.org/Virus.DOS.HLLO.Nazi.4240

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:30:45.976614521Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:30:45.977963072Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:30:45.978977396Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:30:45.979953427Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:30:45.98147251Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:30:45.98287219Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:30:45.983863505Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:30:45.99008355Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:30:45.991120547Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:30:45.992076797Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:30:45.993547433Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:30:45.994538026Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:30:45.99553933Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:30:45.997146867Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:30:45.998247199Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:30:45.999181231Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:30:46.000678539Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:30:46.002444989Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:30:46.00343993Z 53 PC: 12f62 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:30:46.007601887Z 37 PC: 12f77 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:30:46.00862529Z 37 PC: 12f7f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:30:46.009520096Z 37 PC: 12f87 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:30:46.010661553Z 37 PC: 12f8f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:30:46.011999646Z 68 PC: 132ac | I/O control for devices (Set for = '')
2018-12-17T22:30:46.013243118Z 42 PC: 12de7 | Get date 0x12de7: xor ah, ah
0x12de9: les di, ptr [bp + 6]
0x12dec: stosw word ptr es:[di], ax
0x12ded: mov al, dl
0x12def: les di, ptr [bp + 0xa]
0x12df2: stosw word ptr es:[di], ax
0x12df3: mov al, dh
0x12df5: les di, ptr [bp + 0xe]
0x12df8: stosw word ptr es:[di], ax
0x12df9: xchg ax, cx
0x12dfa: les di, ptr [bp + 0x12]
0x12dfd: stosw word ptr es:[di], ax
0x12dfe: pop bp
0x12dff: retf 0x10
0x12e02: push bp
0x12e03: mov bp, sp
0x12e05: mov cx, word ptr [bp + 0xa]
0x12e08: mov dh, byte ptr [bp + 8]
0x12e0b: mov dl, byte ptr [bp + 6]
0x12e0e: mov ah, 0x2b
2018-12-17T22:30:46.01569537Z 26 PC: 12eb9 | Set disk transfer address
2018-12-17T22:30:46.017369217Z 78 PC: 12ec5 | Find first file
2018-12-17T22:30:46.023236164Z 26 PC: 12edd | Set disk transfer address
2018-12-17T22:30:46.024113405Z 79 PC: 12ee2 | Find next file
2018-12-17T22:30:46.026584366Z 61 PC: 137e3 | Open file (Filename = 'TEST.EXE')
2018-12-17T22:30:46.032716426Z 63 PC: 138b6 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:30:46.035003154Z 62 PC: 13833 | Close file
2018-12-17T22:30:46.037173117Z 48 PC: 13931 | Get DOS version
2018-12-17T22:30:46.038450883Z 61 PC: 137e3 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:30:46.044651857Z 63 PC: 138b6 | Read file or device (Read 4240 bytes on handle 5)
2018-12-17T22:30:46.052046185Z 62 PC: 13833 | Close file
2018-12-17T22:30:46.055021257Z 61 PC: 137e3 | Open file (Filename = 'TEST.EXE')
2018-12-17T22:30:46.061624305Z 64 PC: 138b6 | Write file or device (Write 4240 bytes on handle 5)
2018-12-17T22:30:46.076123188Z 67 PC: 12e88 | Get or set file attributes
2018-12-17T22:30:46.080938487Z 62 PC: 13833 | Close file
2018-12-17T22:30:46.088581647Z 64 PC: 133af | Write file or device (Write 0 bytes on handle 1)
2018-12-17T22:30:46.090702146Z 37 PC: 13076 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:30:46.091883201Z 37 PC: 13076 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:30:46.092717488Z 37 PC: 13076 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:30:46.093984113Z 37 PC: 13076 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:30:46.094874773Z 37 PC: 13076 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:30:46.095893006Z 37 PC: 13076 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:30:46.097558571Z 37 PC: 13076 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:30:46.098352499Z 37 PC: 13076 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:30:46.099102683Z 37 PC: 13076 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:30:46.100380282Z 37 PC: 13076 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:30:46.101499975Z 37 PC: 13076 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:30:46.102610057Z 37 PC: 13076 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:30:46.103992972Z 37 PC: 13076 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:30:46.105144667Z 37 PC: 13076 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:30:46.106091803Z 37 PC: 13076 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:30:46.107359175Z 37 PC: 13076 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:30:46.108418062Z 37 PC: 13076 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:30:46.109598178Z 37 PC: 13076 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:30:46.11127169Z 37 PC: 13076 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:30:46.125813764Z 76 PC: 130b5 | Terminate with return code (Return code = '0')