Sample viewer

vx.netlux.org/Virus.DOS.Jerusalem.n2

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:34:58.671035725Z 224 PC: 12ade | UNKNOWN!
2018-12-17T22:34:58.673950011Z 224 PC: 12b32 | UNKNOWN!
2018-12-17T22:34:58.674794536Z 74 PC: 12bb6 | Reallocate memory
2018-12-17T22:34:58.675823535Z 53 PC: 12bbb | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:34:58.677550332Z 37 PC: 12bcf | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:34:58.67914087Z 42 PC: 12bff | Get date 0x12bff: mov byte ptr cs:[0x12], 0
0x12c05: cmp cx, 0x7c3
0x12c09: je 0x12c3a
0x12c0b: cmp al, 5
0x12c0d: jne 0x12c1b
0x12c0f: cmp al, 0xd
0x12c11: jne 0x12c1b
0x12c13: inc byte ptr cs:[0x12]
0x12c18: jmp 0x12c3a
0x12c1a: nop
0x12c1b: mov ax, 0x3508
0x12c1e: int 0x21
0x12c20: mov word ptr cs:[0x17], bx
0x12c25: mov word ptr cs:[0x19], es
0x12c2a: push cs
0x12c2b: pop ds
0x12c2c: mov word ptr [0x23], 0x21c
0x12c32: mov ax, 0x2508
0x12c35: mov dx, 0x221
0x12c38: int 0x21
2018-12-17T22:34:58.68112182Z 53 PC: 12c20 | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:34:58.683563304Z 37 PC: 12c3a | Set interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-17T22:34:58.685059188Z 75 PC: 12c46 | Execute program
2018-12-17T22:34:58.695456444Z 9 PC: 132e5 | Display string (String= ' ')
2018-12-17T22:34:58.700516149Z 0 PC: 132e9 | Program terminate
2018-12-17T22:34:58.702940976Z 73 PC: 12c4c | Release memory
2018-12-17T22:34:58.704157457Z 77 PC: 12c50 | Get program return code
2018-12-17T22:34:58.705395021Z 49 PC: 12c5e | Terminate and stay resident (Return code = '0' | Memory size = '112')