Sample viewer

vx.netlux.org/Virus.DOS.Kwok.1618

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:41:08.278625098Z 42 PC: 12a52 | Get date 0x12a52: cmp dl, 1
0x12a55: je 0x12a5a
0x12a57: jmp 0x12c4f
0x12a5a: mov ah, 0xf
0x12a5c: int 0x10
0x12a5e: mov byte ptr cs:[0x1f7], bh
0x12a63: mov cx, 0x10
0x12a66: mov si, 0x1f8
0x12a69: mov dx, 0
0x12a6c: mov ax, word ptr cs:[si]
0x12a6f: mov cx, 0x19
0x12a72: push cx
0x12a73: mov cx, 5
0x12a76: push cx
0x12a77: mov ax, word ptr cs:[si]
0x12a7a: mov cx, 0x10
0x12a7d: push cx
0x12a7e: rol ax, 1
0x12a80: push ax
0x12a81: push ax
2018-12-17T22:41:08.281744378Z 74 PC: 12ca2 | Reallocate memory
2018-12-17T22:41:08.284610981Z 75 PC: 12cc6 | Execute program
2018-12-17T22:41:08.298488848Z 42 PC: 22ba2 | Get date 0x22ba2: cmp dl, 1
0x22ba5: je 0x22baa
0x22ba7: jmp 0x22d9f
0x22baa: mov ah, 0xf
0x22bac: int 0x10
0x22bae: mov byte ptr cs:[0x1f7], bh
0x22bb3: mov cx, 0x10
0x22bb6: mov si, 0x1f8
0x22bb9: mov dx, 0
0x22bbc: mov ax, word ptr cs:[si]
0x22bbf: mov cx, 0x19
0x22bc2: push cx
0x22bc3: mov cx, 5
0x22bc6: push cx
0x22bc7: mov ax, word ptr cs:[si]
0x22bca: mov cx, 0x10
0x22bcd: push cx
0x22bce: rol ax, 1
0x22bd0: push ax
0x22bd1: push ax
2018-12-17T22:41:08.302976102Z 73 PC: 12ccc | Release memory
2018-12-17T22:41:08.304942624Z 77 PC: 12cd0 | Get program return code
2018-12-17T22:41:08.308013437Z 49 PC: 12ce2 | Terminate and stay resident (Return code = '0' | Memory size = '326')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":7153,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:00:53.839602344Z 64 PC: 0 | Write file or device (Write 2 bytes on handle 1)
2018-12-25T12:00:53.846301031Z 41 PC: 94fae | Parse filename
2018-12-25T12:00:53.850956267Z 41 PC: 9502f | Parse filename
2018-12-25T12:00:53.852899806Z 41 PC: 9504c | Parse filename
2018-12-25T12:00:53.858760598Z 26 PC: 984f7 | Set disk transfer address
2018-12-25T12:00:53.863498063Z 71 PC: 986f3 | Get current directory
2018-12-25T12:00:53.867822802Z 78 PC: 986fe | Find first file
2018-12-25T12:00:53.877145035Z 71 PC: 986f3 | Get current directory (See above)
2018-12-25T12:00:53.880348482Z 78 PC: 986fe | Find first file (See above)
2018-12-25T12:00:53.891279866Z 64 PC: 9a848 | Write file or device (Write 26 bytes on handle 2)
2018-12-25T12:00:53.896066405Z 37 PC: 123c4 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T12:00:53.899282254Z 37 PC: 123cb | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T12:00:53.900655894Z 37 PC: 123d2 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:00:53.902258421Z 62 PC: 122ab | Close file
2018-12-25T12:00:53.912209742Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.915295614Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.917189777Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.919990496Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.921805601Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.923734447Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.925719809Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.928828195Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.930848656Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.932747486Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.935294001Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.936996353Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.938737709Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.940431197Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:00:53.942322478Z 99 PC: 9a5d7 | Get DBCS lead byte table pointer
2018-12-25T12:00:53.944152531Z 56 PC: 94df9 | Get or set country info
2018-12-25T12:00:53.945622652Z 64 PC: 9a848 | Write file or device (See above)
2018-12-25T12:00:53.948472331Z 25 PC: 94e62 | Get default drive
2018-12-25T12:00:53.950570459Z 71 PC: 970dd | Get current directory
2018-12-25T12:00:53.970965387Z 64 PC: 9a848 | Write file or device (See above)
2018-12-25T12:00:53.97641575Z 2 PC: 970b2 | Character output (Char = '3e')
2018-12-25T12:00:53.980956886Z 93 PC: 94f20 | File sharing functions
2018-12-25T12:00:53.982612645Z 93 PC: 94f27 | File sharing functions
2018-12-25T12:00:53.984375445Z 10 PC: 94f39 | Buffered keyboard input
2018-12-25T12:01:08.869462069Z 0 PC: 0 | Program terminate (See above)
2018-12-25T12:01:10.222587407Z 0 PC: 0 | Program terminate (See above)
2018-12-25T12:01:10.325498517Z 64 PC: 9a848 | Write file or device (See above)
2018-12-25T12:01:10.331332083Z 41 PC: 94fae | Parse filename (See above)
2018-12-25T12:01:10.333544427Z 41 PC: 9502f | Parse filename (See above)
2018-12-25T12:01:10.33577152Z 41 PC: 9504c | Parse filename (See above)
2018-12-25T12:01:10.339088376Z 26 PC: 984f7 | Set disk transfer address (See above)
2018-12-25T12:01:10.340629513Z 71 PC: 986f3 | Get current directory (See above)
2018-12-25T12:01:10.350576702Z 78 PC: 986fe | Find first file (See above)
2018-12-25T12:01:10.360065234Z 71 PC: 9856c | Get current directory
2018-12-25T12:01:10.363368253Z 73 PC: 97c09 | Release memory
2018-12-25T12:01:10.365682716Z 75 PC: 11821 | Execute program
2018-12-25T12:01:10.381837929Z 9 PC: 12a47 | Display string (String= 'Hello, World! ')
2018-12-25T12:01:10.385773669Z 76 PC: 12a4b | Terminate with return code (Return code = '36')

{"DateBased":true,"Day":2,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":7153,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:00:53.919483952Z 42 PC: 12a52 | Get date 0x12a52: cmp dl, 1
0x12a55: je 0x12a5a
0x12a57: jmp 0x12c4f
0x12a5a: mov ah, 0xf
0x12a5c: int 0x10
0x12a5e: mov byte ptr cs:[0x1f7], bh
0x12a63: mov cx, 0x10
0x12a66: mov si, 0x1f8
0x12a69: mov dx, 0
0x12a6c: mov ax, word ptr cs:[si]
0x12a6f: mov cx, 0x19
0x12a72: push cx
0x12a73: mov cx, 5
0x12a76: push cx
0x12a77: mov ax, word ptr cs:[si]
0x12a7a: mov cx, 0x10
0x12a7d: push cx
0x12a7e: rol ax, 1
0x12a80: push ax
0x12a81: push ax
2018-12-25T12:00:53.923049224Z 74 PC: 12ca2 | Reallocate memory
2018-12-25T12:00:53.924672348Z 75 PC: 12cc6 | Execute program
2018-12-25T12:00:53.938885294Z 42 PC: 22ba2 | Get date 0x22ba2: cmp dl, 1
0x22ba5: je 0x22baa
0x22ba7: jmp 0x22d9f
0x22baa: mov ah, 0xf
0x22bac: int 0x10
0x22bae: mov byte ptr cs:[0x1f7], bh
0x22bb3: mov cx, 0x10
0x22bb6: mov si, 0x1f8
0x22bb9: mov dx, 0
0x22bbc: mov ax, word ptr cs:[si]
0x22bbf: mov cx, 0x19
0x22bc2: push cx
0x22bc3: mov cx, 5
0x22bc6: push cx
0x22bc7: mov ax, word ptr cs:[si]
0x22bca: mov cx, 0x10
0x22bcd: push cx
0x22bce: rol ax, 1
0x22bd0: push ax
0x22bd1: push ax
2018-12-25T12:00:53.943341237Z 73 PC: 12ccc | Release memory
2018-12-25T12:00:53.945239736Z 77 PC: 12cd0 | Get program return code
2018-12-25T12:00:53.946659905Z 49 PC: 12ce2 | Terminate and stay resident (Return code = '0' | Memory size = '326')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":7153,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:00:54.072844225Z 42 PC: 12a52 | Get date 0x12a52: cmp dl, 1
0x12a55: je 0x12a5a
0x12a57: jmp 0x12c4f
0x12a5a: mov ah, 0xf
0x12a5c: int 0x10
0x12a5e: mov byte ptr cs:[0x1f7], bh
0x12a63: mov cx, 0x10
0x12a66: mov si, 0x1f8
0x12a69: mov dx, 0
0x12a6c: mov ax, word ptr cs:[si]
0x12a6f: mov cx, 0x19
0x12a72: push cx
0x12a73: mov cx, 5
0x12a76: push cx
0x12a77: mov ax, word ptr cs:[si]
0x12a7a: mov cx, 0x10
0x12a7d: push cx
0x12a7e: rol ax, 1
0x12a80: push ax
0x12a81: push ax
2018-12-25T12:00:54.087432689Z 60 PC: 12b25 | Create or truncate file
2018-12-25T12:00:54.447701763Z 64 PC: 12b31 | Write file or device (Write 4000 bytes on handle 5)
2018-12-25T12:00:54.45732409Z 62 PC: 12b35 | Close file

{"DateBased":true,"Day":2,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":7153,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:00:55.057595854Z 42 PC: 12a52 | Get date 0x12a52: cmp dl, 1
0x12a55: je 0x12a5a
0x12a57: jmp 0x12c4f
0x12a5a: mov ah, 0xf
0x12a5c: int 0x10
0x12a5e: mov byte ptr cs:[0x1f7], bh
0x12a63: mov cx, 0x10
0x12a66: mov si, 0x1f8
0x12a69: mov dx, 0
0x12a6c: mov ax, word ptr cs:[si]
0x12a6f: mov cx, 0x19
0x12a72: push cx
0x12a73: mov cx, 5
0x12a76: push cx
0x12a77: mov ax, word ptr cs:[si]
0x12a7a: mov cx, 0x10
0x12a7d: push cx
0x12a7e: rol ax, 1
0x12a80: push ax
0x12a81: push ax
2018-12-25T12:00:55.067705713Z 74 PC: 12ca2 | Reallocate memory
2018-12-25T12:00:55.068825029Z 75 PC: 12cc6 | Execute program
2018-12-25T12:00:55.079886968Z 42 PC: 22ba2 | Get date 0x22ba2: cmp dl, 1
0x22ba5: je 0x22baa
0x22ba7: jmp 0x22d9f
0x22baa: mov ah, 0xf
0x22bac: int 0x10
0x22bae: mov byte ptr cs:[0x1f7], bh
0x22bb3: mov cx, 0x10
0x22bb6: mov si, 0x1f8
0x22bb9: mov dx, 0
0x22bbc: mov ax, word ptr cs:[si]
0x22bbf: mov cx, 0x19
0x22bc2: push cx
0x22bc3: mov cx, 5
0x22bc6: push cx
0x22bc7: mov ax, word ptr cs:[si]
0x22bca: mov cx, 0x10
0x22bcd: push cx
0x22bce: rol ax, 1
0x22bd0: push ax
0x22bd1: push ax
2018-12-25T12:00:55.085040379Z 73 PC: 12ccc | Release memory
2018-12-25T12:00:55.086111548Z 77 PC: 12cd0 | Get program return code
2018-12-25T12:00:55.087110436Z 49 PC: 12ce2 | Terminate and stay resident (Return code = '0' | Memory size = '326')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":7153,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:00:55.288723333Z 42 PC: 12a52 | Get date 0x12a52: cmp dl, 1
0x12a55: je 0x12a5a
0x12a57: jmp 0x12c4f
0x12a5a: mov ah, 0xf
0x12a5c: int 0x10
0x12a5e: mov byte ptr cs:[0x1f7], bh
0x12a63: mov cx, 0x10
0x12a66: mov si, 0x1f8
0x12a69: mov dx, 0
0x12a6c: mov ax, word ptr cs:[si]
0x12a6f: mov cx, 0x19
0x12a72: push cx
0x12a73: mov cx, 5
0x12a76: push cx
0x12a77: mov ax, word ptr cs:[si]
0x12a7a: mov cx, 0x10
0x12a7d: push cx
0x12a7e: rol ax, 1
0x12a80: push ax
0x12a81: push ax
2018-12-25T12:00:55.30252441Z 60 PC: 12b25 | Create or truncate file
2018-12-25T12:00:55.660695515Z 64 PC: 12b31 | Write file or device (Write 4000 bytes on handle 5)
2018-12-25T12:00:55.669691285Z 62 PC: 12b35 | Close file

{"DateBased":true,"Day":2,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":7153,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:00:55.558136798Z 42 PC: 12a52 | Get date 0x12a52: cmp dl, 1
0x12a55: je 0x12a5a
0x12a57: jmp 0x12c4f
0x12a5a: mov ah, 0xf
0x12a5c: int 0x10
0x12a5e: mov byte ptr cs:[0x1f7], bh
0x12a63: mov cx, 0x10
0x12a66: mov si, 0x1f8
0x12a69: mov dx, 0
0x12a6c: mov ax, word ptr cs:[si]
0x12a6f: mov cx, 0x19
0x12a72: push cx
0x12a73: mov cx, 5
0x12a76: push cx
0x12a77: mov ax, word ptr cs:[si]
0x12a7a: mov cx, 0x10
0x12a7d: push cx
0x12a7e: rol ax, 1
0x12a80: push ax
0x12a81: push ax
2018-12-25T12:00:55.56051636Z 74 PC: 12ca2 | Reallocate memory
2018-12-25T12:00:55.562881739Z 75 PC: 12cc6 | Execute program
2018-12-25T12:00:55.57875504Z 42 PC: 22ba2 | Get date 0x22ba2: cmp dl, 1
0x22ba5: je 0x22baa
0x22ba7: jmp 0x22d9f
0x22baa: mov ah, 0xf
0x22bac: int 0x10
0x22bae: mov byte ptr cs:[0x1f7], bh
0x22bb3: mov cx, 0x10
0x22bb6: mov si, 0x1f8
0x22bb9: mov dx, 0
0x22bbc: mov ax, word ptr cs:[si]
0x22bbf: mov cx, 0x19
0x22bc2: push cx
0x22bc3: mov cx, 5
0x22bc6: push cx
0x22bc7: mov ax, word ptr cs:[si]
0x22bca: mov cx, 0x10
0x22bcd: push cx
0x22bce: rol ax, 1
0x22bd0: push ax
0x22bd1: push ax
2018-12-25T12:00:55.583750398Z 73 PC: 12ccc | Release memory
2018-12-25T12:00:55.585811976Z 77 PC: 12cd0 | Get program return code
2018-12-25T12:00:55.587063738Z 49 PC: 12ce2 | Terminate and stay resident (Return code = '0' | Memory size = '326')