Sample viewer

vx.netlux.org/Virus.DOS.Virogen.Pinworm.2169

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:34:54.844664631Z 72 PC: 8f1b9 | Allocate memory
2018-12-17T22:34:54.846985378Z 72 PC: 8f1bd | Allocate memory
2018-12-17T22:34:54.849453834Z 99 PC: 90858 | Get DBCS lead byte table pointer
2018-12-17T22:34:54.852527077Z 61 PC: 91f88 | Open file (Filename = 'C:\WINDOWS\HIMEM.SYS')
2018-12-17T22:34:54.863732374Z 66 PC: 91f95 | Move file pointer
2018-12-17T22:34:54.865161942Z 62 PC: 91fc1 | Close file
2018-12-17T22:34:54.867144492Z 75 PC: 91fe0 | Execute program
2018-12-17T22:34:54.883307239Z 98 PC: 916f1 | Get current PSP
2018-12-17T22:34:54.884747816Z 9 PC: c605 | Display string (String= '6��r�&;] u')
2018-12-17T22:34:54.894042072Z 48 PC: c609 | Get DOS version
2018-12-17T22:34:54.89828816Z 9 PC: c382 | Display string (String= ' Installed A20 handler number ')
2018-12-17T22:34:54.902312796Z 2 PC: c38c | Character output (Char = '32')
2018-12-17T22:34:54.904812506Z 2 PC: c3a7 | Character output (Char = '2e')
2018-12-17T22:34:54.908727049Z 9 PC: c6d9 | Display string (String= '�����VH�VD���V@��������������_���Ku��t1��������D�����t �� ��������a1��Z�����W���� ������5���|�����(���������Nj�(��������p�^')
2018-12-17T22:34:54.915835159Z 9 PC: c6e0 | Display string (String= '�5���|�����(���������Nj�(��������p�^')
2018-12-17T22:34:54.925069095Z 61 PC: 91f88 | Open file (Filename = 'C:\WINDOWS\SMARTDRV.EXE')
2018-12-17T22:34:54.936110949Z 66 PC: 91f95 | Move file pointer
2018-12-17T22:34:54.93962536Z 62 PC: 91fc1 | Close file
2018-12-17T22:34:54.941532522Z 75 PC: 91fe0 | Execute program
2018-12-17T22:34:54.961967817Z 98 PC: 916f1 | Get current PSP
2018-12-17T22:34:54.966246115Z 82 PC: 13d46 | Get DOS internal pointers (SYSVARS)
2018-12-17T22:34:54.967547334Z 53 PC: 13ac3 | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-17T22:34:54.968673719Z 37 PC: 13ad6 | Set interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-17T22:34:54.970679803Z 53 PC: 13ae0 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:34:54.971757376Z 37 PC: 13af3 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:34:54.972802515Z 9 PC: 13a0d | Display string (Could not find end pointer)
2018-12-17T22:34:54.98459494Z 62 PC: 8f8eb | Close file
2018-12-17T22:34:54.986446367Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:54.98838502Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:54.99064885Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:54.992324359Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:54.993960816Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:54.996511588Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:54.998136165Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:54.999676965Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.002093978Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.003626535Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.005956322Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.009935524Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.012385238Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.013866055Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.01526918Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.017805844Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.019212144Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.020567077Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.022901247Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.024531434Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.026238916Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.028547408Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.030086301Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.031572914Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.033500022Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.034954954Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.036368513Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.038363466Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.039710465Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.041043548Z 62 PC: 8f8f2 | Close file
2018-12-17T22:34:55.042940196Z 61 PC: 8f8ff | Open file (Filename = '')
2018-12-17T22:34:55.047600489Z 62 PC: 8f90e | Close file
2018-12-17T22:34:55.049276329Z 69 PC: 8f915 | Duplicate handle
2018-12-17T22:34:55.051330694Z 69 PC: 8f919 | Duplicate handle
2018-12-17T22:34:55.052858577Z 61 PC: 9387b | Open file (Filename = '')
2018-12-17T22:34:55.057277846Z 68 PC: 9386b | I/O control for devices (Set for = '')
2018-12-17T22:34:55.059482332Z 61 PC: 9387b | Open file (Filename = '')
2018-12-17T22:34:55.064496522Z 68 PC: 9386b | I/O control for devices (Set for = '')
2018-12-17T22:34:55.065961185Z 74 PC: 8f9c4 | Reallocate memory
2018-12-17T22:34:55.067581948Z 72 PC: 8f9e0 | Allocate memory
2018-12-17T22:34:55.06934532Z 72 PC: 8f9e4 | Allocate memory
2018-12-17T22:34:55.070969472Z 74 PC: 8f9fb | Reallocate memory
2018-12-17T22:34:55.073262241Z 72 PC: 8fa02 | Allocate memory
2018-12-17T22:34:55.075032952Z 72 PC: 8fa06 | Allocate memory
2018-12-17T22:34:55.076631827Z 73 PC: 8fa11 | Release memory
2018-12-17T22:34:55.078477704Z 73 PC: 8efea | Release memory
2018-12-17T22:34:55.080436791Z 74 PC: 8f003 | Reallocate memory
2018-12-17T22:34:55.081898481Z 72 PC: 8f054 | Allocate memory
2018-12-17T22:34:55.08367456Z 72 PC: 8f058 | Allocate memory
2018-12-17T22:34:55.085543395Z 73 PC: 8f060 | Release memory
2018-12-17T22:34:55.086770059Z 61 PC: 8f080 | Open file (Filename = 'r,�S�������[�
2018-12-17T22:34:55.095320543Z 63 PC: 8f095 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:34:55.101282153Z 66 PC: 8f0ad | Move file pointer
2018-12-17T22:34:55.102702785Z 62 PC: 8f0d1 | Close file
2018-12-17T22:34:55.104453805Z 75 PC: 8f0f2 | Execute program
2018-12-17T22:34:55.124382523Z 80 PC: 12be9 | Set current PSP
2018-12-17T22:34:55.125445882Z 48 PC: 12bee | Get DOS version
2018-12-17T22:34:55.127293457Z 99 PC: 193d0 | Get DBCS lead byte table pointer
2018-12-17T22:34:55.130497658Z 101 PC: 12c74 | Get extended country info
2018-12-17T22:34:55.132098877Z 99 PC: 12c7a | Get DBCS lead byte table pointer
2018-12-17T22:34:55.133693383Z 74 PC: 12cdc | Reallocate memory
2018-12-17T22:34:55.136973718Z 72 PC: 1355d | Allocate memory
2018-12-17T22:34:55.138764774Z 25 PC: 13596 | Get default drive
2018-12-17T22:34:55.140012097Z 71 PC: 135ad | Get current directory
2018-12-17T22:34:55.143199111Z 59 PC: 135ba | Change current directory
2018-12-17T22:34:55.148535495Z 59 PC: 135c8 | Change current directory
2018-12-17T22:34:55.153929832Z 59 PC: 135d3 | Change current directory
2018-12-17T22:34:55.158172271Z 25 PC: 12d13 | Get default drive
2018-12-17T22:34:55.159332007Z 37 PC: 127d3 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T22:34:55.160409755Z 37 PC: 127da | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:34:55.162737649Z 37 PC: 127e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:34:55.165036753Z 80 PC: 1301d | Set current PSP
2018-12-17T22:34:55.165870981Z 37 PC: 13041 | Set interrupt vector (Interrupt = '46' AKA 'Set verify flag')
2018-12-17T22:34:55.167714342Z 53 PC: 13362 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:34:55.168817601Z 37 PC: 13383 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:34:55.169864898Z 51 PC: 13417 | Get or set Ctrl-Break
2018-12-17T22:34:55.172343252Z 72 PC: 130ec | Allocate memory
2018-12-17T22:34:55.174549726Z 61 PC: 131b2 | Open file (Filename = '')
2018-12-17T22:34:55.183558948Z 62 PC: 131ba | Close file
2018-12-17T22:34:55.185510999Z 51 PC: 1344c | Get or set Ctrl-Break
2018-12-17T22:34:55.186421344Z 74 PC: 1197c | Reallocate memory
2018-12-17T22:34:55.187550694Z 72 PC: 11991 | Allocate memory
2018-12-17T22:34:55.189285648Z 73 PC: 119b2 | Release memory
2018-12-17T22:34:55.190279991Z 72 PC: 119bd | Allocate memory
2018-12-17T22:34:55.191482718Z 73 PC: 119df | Release memory
2018-12-17T22:34:55.193015905Z 72 PC: 119f5 | Allocate memory
2018-12-17T22:34:55.194145219Z 72 PC: 119fd | Allocate memory