Sample viewer

vx.netlux.org/Virus.DOS.Flavour.989

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:43:40.214852738Z 42 PC: 12a5a | Get date 0x12a5a: cmp dx, 0x909
0x12a5e: jne 0x12a6b
0x12a60: mov ah, 9
0x12a62: lea dx, word ptr [si + 0x138]
0x12a66: int 0x21
0x12a68: cli
0x12a69: jmp 0x12a67
0x12a6b: mov ax, 0x8f00
0x12a6e: int 0x21
0x12a70: cmp ax, 0x8f
0x12a73: jne 0x12a84
0x12a75: add si, 0x124
0x12a79: mov di, 0x100
0x12a7c: push ss
0x12a7d: push di
0x12a7e: cld
0x12a7f: movsw word ptr es:[di], word ptr [si]
0x12a80: movsw word ptr es:[di], word ptr [si]
0x12a81: push ss
0x12a82: pop ds
2018-12-17T22:43:40.217929386Z 143 PC: 12a70 | UNKNOWN!
2018-12-17T22:43:40.219690093Z 82 PC: 12a8a | Get DOS internal pointers (SYSVARS)
2018-12-17T22:43:40.221919641Z 82 PC: 9f4fa | Get DOS internal pointers (SYSVARS)

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":7957,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:02:59.510194997Z 42 PC: 12a5a | Get date 0x12a5a: cmp dx, 0x909
0x12a5e: jne 0x12a6b
0x12a60: mov ah, 9
0x12a62: lea dx, word ptr [si + 0x138]
0x12a66: int 0x21
0x12a68: cli
0x12a69: jmp 0x12a67
0x12a6b: mov ax, 0x8f00
0x12a6e: int 0x21
0x12a70: cmp ax, 0x8f
0x12a73: jne 0x12a84
0x12a75: add si, 0x124
0x12a79: mov di, 0x100
0x12a7c: push ss
0x12a7d: push di
0x12a7e: cld
0x12a7f: movsw word ptr es:[di], word ptr [si]
0x12a80: movsw word ptr es:[di], word ptr [si]
0x12a81: push ss
0x12a82: pop ds
2018-12-25T12:02:59.513400681Z 143 PC: 12a70 | UNKNOWN!
2018-12-25T12:02:59.514437164Z 82 PC: 12a8a | Get DOS internal pointers (SYSVARS)
2018-12-25T12:02:59.51613406Z 82 PC: 9f4fa | Get DOS internal pointers (SYSVARS)

{"DateBased":true,"Day":9,"Month":9,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":7957,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:03:00.371190356Z 42 PC: 12a5a | Get date 0x12a5a: cmp dx, 0x909
0x12a5e: jne 0x12a6b
0x12a60: mov ah, 9
0x12a62: lea dx, word ptr [si + 0x138]
0x12a66: int 0x21
0x12a68: cli
0x12a69: jmp 0x12a67
0x12a6b: mov ax, 0x8f00
0x12a6e: int 0x21
0x12a70: cmp ax, 0x8f
0x12a73: jne 0x12a84
0x12a75: add si, 0x124
0x12a79: mov di, 0x100
0x12a7c: push ss
0x12a7d: push di
0x12a7e: cld
0x12a7f: movsw word ptr es:[di], word ptr [si]
0x12a80: movsw word ptr es:[di], word ptr [si]
0x12a81: push ss
0x12a82: pop ds
2018-12-25T12:03:00.373923611Z 9 PC: 12a68 | Display string (String= 'Hello !! I am [Flavour V1.2] By Dark Killer ... At Taiwan Power Virus Organization ! 1995/07/02/Sunday ')