Sample viewer

vx.netlux.org/Virus.DOS.Hellfire.1089

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:31:04.357063325Z 78 PC: 12a4c | Find first file
2018-12-17T22:31:04.361099713Z 61 PC: 12a56 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:31:04.365979124Z 63 PC: 12a61 | Read file or device (Read 1 bytes on handle 5)
2018-12-17T22:31:04.370273044Z 62 PC: 12a65 | Close file
2018-12-17T22:31:04.372216923Z 61 PC: 12a76 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:31:04.380144087Z 44 PC: 12a7b | Get time 0x12a7b: mov word ptr [0x53d], dx
0x12a7f: mov ah, 0x40
0x12a81: push ax
0x12a82: mov cx, 0x441
0x12a85: push cx
0x12a86: mov dx, 0x100
0x12a89: jmp 0x12e60
0x12a8c: mov ah, 9
0x12a8e: mov dx, 0x1d6
0x12a91: int 0x21
0x12a93: int 0x20
0x12a95: mov ah, 0xf
0x12a97: int 0x10
0x12a99: xor ah, ah
0x12a9b: int 0x10
0x12a9d: mov ah, 1
0x12a9f: mov cx, 0x2607
0x12aa2: int 0x10
0x12aa4: mov ax, 0xb800
0x12aa7: mov es, ax
2018-12-17T22:31:04.383041433Z 64 PC: 12e67 | Write file or device (Write 1089 bytes on handle 5)
2018-12-17T22:31:04.399463621Z 9 PC: 12a93 | Display string (String= 'Bad command or file name ')