Sample viewer

vx.netlux.org/Virus.DOS.HLLC.4505.b

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:43:05.467921266Z 53 PC: 13462 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:43:05.471057286Z 53 PC: 13462 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:43:05.47325301Z 53 PC: 13462 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:43:05.474883292Z 53 PC: 13462 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:43:05.476729549Z 53 PC: 13462 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:43:05.478543076Z 53 PC: 13462 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:43:05.479881981Z 53 PC: 13462 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:43:05.481191791Z 53 PC: 13462 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:43:05.483439131Z 53 PC: 13462 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:43:05.484957804Z 53 PC: 13462 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:43:05.486882719Z 53 PC: 13462 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:43:05.489628375Z 53 PC: 13462 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:43:05.491468502Z 53 PC: 13462 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:43:05.493337552Z 53 PC: 13462 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:43:05.495902309Z 53 PC: 13462 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:43:05.497445006Z 53 PC: 13462 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:43:05.498770276Z 53 PC: 13462 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:43:05.500766265Z 53 PC: 13462 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:43:05.502252055Z 53 PC: 13462 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:43:05.50371866Z 37 PC: 13477 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:43:05.507303272Z 37 PC: 1347f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:43:05.510237644Z 37 PC: 13487 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:43:05.51172145Z 37 PC: 1348f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:43:05.513961367Z 68 PC: 137ac | I/O control for devices (Set for = '')
2018-12-17T22:43:05.516265064Z 44 PC: 13c16 | Get time 0x13c16: mov word ptr [0x3e], cx
0x13c1a: mov word ptr [0x40], dx
0x13c1e: retf
0x13c1f: mov bx, sp
0x13c21: push ds
0x13c22: les di, ptr ss:[bx + 8]
0x13c26: lds si, ptr ss:[bx + 4]
0x13c2a: cld
0x13c2b: xor ax, ax
0x13c2d: stosw word ptr es:[di], ax
0x13c2e: mov ax, 0xd7b0
0x13c31: stosw word ptr es:[di], ax
0x13c32: xor ax, ax
0x13c34: mov cx, 0x16
0x13c37: rep stosd dword ptr es:[di], eax
0x13c39: lodsb al, byte ptr [si]
0x13c3a: cmp al, 0x4f
0x13c3c: jbe 0x13c40
0x13c3e: mov al, 0x4f
0x13c40: mov cl, al
2018-12-17T22:43:05.518882039Z 48 PC: 13ed5 | Get DOS version
2018-12-17T22:43:05.522145208Z 67 PC: 13304 | Get or set file attributes
2018-12-17T22:43:05.529505061Z 25 PC: 13370 | Get default drive
2018-12-17T22:43:05.530983778Z 71 PC: 1338f | Get current directory
2018-12-17T22:43:05.534809574Z 26 PC: 1316b | Set disk transfer address
2018-12-17T22:43:05.536671922Z 78 PC: 13177 | Find first file
2018-12-17T22:43:05.543006719Z 26 PC: 1318f | Set disk transfer address
2018-12-17T22:43:05.544312843Z 79 PC: 13194 | Find next file
2018-12-17T22:43:05.548551173Z 26 PC: 1318f | Set disk transfer address
2018-12-17T22:43:05.549826488Z 79 PC: 13194 | Find next file
2018-12-17T22:43:05.55271866Z 26 PC: 1318f | Set disk transfer address
2018-12-17T22:43:05.555172619Z 79 PC: 13194 | Find next file
2018-12-17T22:43:05.559231583Z 26 PC: 1318f | Set disk transfer address
2018-12-17T22:43:05.560849071Z 79 PC: 13194 | Find next file
2018-12-17T22:43:05.564725361Z 26 PC: 1318f | Set disk transfer address
2018-12-17T22:43:05.56592277Z 79 PC: 13194 | Find next file
2018-12-17T22:43:05.568690619Z 26 PC: 1318f | Set disk transfer address
2018-12-17T22:43:05.570832832Z 79 PC: 13194 | Find next file
2018-12-17T22:43:05.573603435Z 26 PC: 1318f | Set disk transfer address
2018-12-17T22:43:05.575026088Z 79 PC: 13194 | Find next file
2018-12-17T22:43:05.577876201Z 26 PC: 1318f | Set disk transfer address
2018-12-17T22:43:05.579578428Z 79 PC: 13194 | Find next file
2018-12-17T22:43:05.582879157Z 26 PC: 1318f | Set disk transfer address
2018-12-17T22:43:05.584517985Z 79 PC: 13194 | Find next file
2018-12-17T22:43:05.590866739Z 64 PC: 138af | Write file or device (Write 0 bytes on handle 1)
2018-12-17T22:43:05.592720931Z 37 PC: 13576 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:43:05.594039648Z 37 PC: 13576 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:43:05.596850077Z 37 PC: 13576 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:43:05.598418653Z 37 PC: 13576 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:43:05.599984804Z 37 PC: 13576 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:43:05.602533351Z 37 PC: 13576 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:43:05.60427893Z 37 PC: 13576 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:43:05.605979794Z 37 PC: 13576 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:43:05.608662913Z 37 PC: 13576 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:43:05.610145848Z 37 PC: 13576 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:43:05.611778946Z 37 PC: 13576 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:43:05.614248434Z 37 PC: 13576 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:43:05.615892532Z 37 PC: 13576 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:43:05.618965774Z 37 PC: 13576 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:43:05.620126123Z 37 PC: 13576 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:43:05.621944108Z 37 PC: 13576 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:43:05.6233826Z 37 PC: 13576 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:43:05.624921159Z 37 PC: 13576 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:43:05.627235886Z 37 PC: 13576 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:43:05.628948403Z 76 PC: 135b5 | Terminate with return code (Return code = '0')