Sample viewer

vx.netlux.org/Virus.DOS.Fist.625

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:41:18.169602934Z 48 PC: 12a9c | Get DOS version
2018-12-17T22:41:18.171095891Z 53 PC: 12ab0 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:41:18.172288161Z 37 PC: 12ac0 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:41:18.17352257Z 78 PC: 12ae5 | Find first file
2018-12-17T22:41:18.180417355Z 67 PC: 12b08 | Get or set file attributes
2018-12-17T22:41:18.198109357Z 61 PC: 12b0f | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:41:18.205611048Z 63 PC: 12b1b | Read file or device (Read 8 bytes on handle 5)
2018-12-17T22:41:18.210298222Z 66 PC: 12b60 | Move file pointer
2018-12-17T22:41:18.21387375Z 44 PC: 12b6f | Get time 0x12b6f: mov si, 0xfb
0x12b72: mov cx, 4
0x12b75: add dx, word ptr [0x107]
0x12b79: mov byte ptr [0xff], dl
0x12b7d: call 0x22a8b
0x12b80: mov ah, 0x40
0x12b82: mov dx, 0xf8
0x12b85: mov cx, 8
0x12b88: int 0x21
0x12b8a: jb 0x12bc6
0x12b8c: call 0x12be8
0x12b8f: mov si, 0xac
0x12b92: mov cx, 8
0x12b95: lea di, word ptr [bp + 0x248]
0x12b99: rep movsb byte ptr es:[di], byte ptr [si]
0x12b9b: mov ax, 0x4202
0x12b9e: xor cx, cx
0x12ba0: mov dx, 1
0x12ba3: int 0x21
0x12ba5: mov ah, 0x2c
2018-12-17T22:41:18.217174416Z 64 PC: 12b8a | Write file or device (Write 8 bytes on handle 5)
2018-12-17T22:41:18.222093726Z 66 PC: 12ba5 | Move file pointer
2018-12-17T22:41:18.224701596Z 44 PC: 12ba9 | Get time 0x12ba9: call 0x12c17
0x12bac: call 0x22a62
0x12baf: mov ax, 0x5701
0x12bb2: mov cx, word ptr [0x96]
0x12bb6: mov dx, word ptr [0x98]
0x12bba: int 0x21
0x12bbc: mov ah, 0x3e
0x12bbe: int 0x21
0x12bc0: call 0x12bf5
0x12bc3: jmp 0x12bc9
0x12bc6: call 0x12be8
0x12bc9: push ds
0x12bca: mov dx, word ptr [bp + 0x246]
0x12bce: mov ds, word ptr [bp + 0x244]
0x12bd2: mov ax, 0x2524
0x12bd5: int 0x21
0x12bd7: pop ds
0x12bd8: pop si
0x12bd9: mov di, 0x80
0x12bdc: mov cx, 0x80
2018-12-17T22:41:18.230593768Z 64 PC: 12a73 | Write file or device (Write 624 bytes on handle 5)
2018-12-17T22:41:18.240419951Z 87 PC: 12bbc | Get or set file date and time
2018-12-17T22:41:18.241992917Z 62 PC: 12bc0 | Close file
2018-12-17T22:41:18.252422654Z 67 PC: 12c03 | Get or set file attributes
2018-12-17T22:41:18.266914019Z 37 PC: 12bd7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')