Sample viewer

vx.netlux.org/Virus.DOS.Assignation.424

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T21:57:34.01962667Z 65 PC: 12a75 | Delete file (Filename = 'is started by using +the SHELL command in the CONFIG.SYS file. F####,$z$$%U%%%,&y&')
2018-12-17T21:57:36.169370997Z 72 PC: 8f1b9 | Allocate memory
2018-12-17T21:57:36.172093184Z 72 PC: 8f1bd | Allocate memory
2018-12-17T21:57:36.174312879Z 99 PC: 90858 | Get DBCS lead byte table pointer
2018-12-17T21:57:36.178030578Z 61 PC: 91f88 | Open file (Filename = 'C:\WINDOWS\HIMEM.SYS')
2018-12-17T21:57:36.188551642Z 66 PC: 91f95 | Move file pointer
2018-12-17T21:57:36.190114219Z 62 PC: 91fc1 | Close file
2018-12-17T21:57:36.194657931Z 75 PC: 91fe0 | Execute program
2018-12-17T21:57:36.210292112Z 98 PC: 916f1 | Get current PSP
2018-12-17T21:57:36.211467733Z 9 PC: c605 | Display string (String= '6r&;] u')
2018-12-17T21:57:36.215928362Z 48 PC: c609 | Get DOS version
2018-12-17T21:57:36.22043869Z 9 PC: c382 | Display string (String= ' Installed A20 handler number ')
2018-12-17T21:57:36.223028233Z 2 PC: c38c | Character output (Char = '32')
2018-12-17T21:57:36.225365582Z 2 PC: c3a7 | Character output (Char = '2e')
2018-12-17T21:57:36.230279767Z 9 PC: c6d9 | Display string (String= 'VHVD[email protected]_Kut1Dt a1ZW 5|(Nj(p^')
2018-12-17T21:57:36.234013208Z 9 PC: c6e0 | Display string (String= '5|(Nj(p^')
2018-12-17T21:57:36.239154474Z 61 PC: 91f88 | Open file (Filename = 'C:\WINDOWS\SMARTDRV.EXE')
2018-12-17T21:57:36.249746125Z 66 PC: 91f95 | Move file pointer
2018-12-17T21:57:36.251303389Z 62 PC: 91fc1 | Close file
2018-12-17T21:57:36.253548195Z 75 PC: 91fe0 | Execute program
2018-12-17T21:57:36.278157194Z 98 PC: 916f1 | Get current PSP
2018-12-17T21:57:36.281813634Z 82 PC: 13d46 | Get DOS internal pointers (SYSVARS)
2018-12-17T21:57:36.283210386Z 53 PC: 13ac3 | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-17T21:57:36.285244179Z 37 PC: 13ad6 | Set interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-17T21:57:36.287132493Z 53 PC: 13ae0 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T21:57:36.288576794Z 37 PC: 13af3 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T21:57:36.29046976Z 9 PC: 13a0d | Display string (Could not find end pointer)
2018-12-17T21:57:36.297889979Z 62 PC: 8f8eb | Close file
2018-12-17T21:57:36.299642003Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.30248501Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.305170877Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.306792948Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.30867908Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.311150962Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.312973799Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.315737319Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.317501824Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.318730432Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.31992971Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.325818186Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.326919144Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.328082381Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.330595195Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.332220405Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.334000995Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.337524394Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.338878261Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.340481795Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.342742504Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.344288138Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.34565847Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.347639622Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.349199763Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.35077986Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.35299567Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.354500462Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.35616128Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.357915135Z 62 PC: 8f8f2 | Close file
2018-12-17T21:57:36.359345042Z 61 PC: 8f8ff | Open file (Filename = '')
2018-12-17T21:57:36.363798554Z 62 PC: 8f90e | Close file
2018-12-17T21:57:36.365864562Z 69 PC: 8f915 | Duplicate handle
2018-12-17T21:57:36.368305037Z 69 PC: 8f919 | Duplicate handle
2018-12-17T21:57:36.369968489Z 61 PC: 9387b | Open file (Filename = '')
2018-12-17T21:57:36.374717121Z 68 PC: 9386b | I/O control for devices (Set for = '')
2018-12-17T21:57:36.376322131Z 61 PC: 9387b | Open file (Filename = '')
2018-12-17T21:57:36.38079849Z 68 PC: 9386b | I/O control for devices (Set for = '')
2018-12-17T21:57:36.382763139Z 74 PC: 8f9c4 | Reallocate memory
2018-12-17T21:57:36.384559394Z 72 PC: 8f9e0 | Allocate memory
2018-12-17T21:57:36.386024001Z 72 PC: 8f9e4 | Allocate memory
2018-12-17T21:57:36.388008214Z 74 PC: 8f9fb | Reallocate memory
2018-12-17T21:57:36.389336547Z 72 PC: 8fa02 | Allocate memory
2018-12-17T21:57:36.390868556Z 72 PC: 8fa06 | Allocate memory
2018-12-17T21:57:36.392874291Z 73 PC: 8fa11 | Release memory
2018-12-17T21:57:36.394561221Z 73 PC: 8efea | Release memory
2018-12-17T21:57:36.396801177Z 74 PC: 8f003 | Reallocate memory
2018-12-17T21:57:36.399529166Z 72 PC: 8f054 | Allocate memory
2018-12-17T21:57:36.401065655Z 72 PC: 8f058 | Allocate memory
2018-12-17T21:57:36.402633455Z 73 PC: 8f060 | Release memory
2018-12-17T21:57:36.404203172Z 61 PC: 8f080 | Open file (Filename = '')
2018-12-17T21:57:36.413336099Z 63 PC: 8f095 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T21:57:36.418522009Z 66 PC: 8f0ad | Move file pointer
2018-12-17T21:57:36.420011904Z 62 PC: 8f0d1 | Close file
2018-12-17T21:57:36.422443075Z 75 PC: 8f0f2 | Execute program
2018-12-17T21:57:36.442442373Z 80 PC: 12be9 | Set current PSP
2018-12-17T21:57:36.443472087Z 48 PC: 12bee | Get DOS version
2018-12-17T21:57:36.445360886Z 99 PC: 193d0 | Get DBCS lead byte table pointer
2018-12-17T21:57:36.44770829Z 101 PC: 12c74 | Get extended country info
2018-12-17T21:57:36.449054334Z 99 PC: 12c7a | Get DBCS lead byte table pointer
2018-12-17T21:57:36.450581323Z 74 PC: 12cdc | Reallocate memory
2018-12-17T21:57:36.451820338Z 72 PC: 1355d | Allocate memory
2018-12-17T21:57:36.453029665Z 25 PC: 13596 | Get default drive
2018-12-17T21:57:36.455316823Z 71 PC: 135ad | Get current directory
2018-12-17T21:57:36.458342388Z 59 PC: 135ba | Change current directory
2018-12-17T21:57:36.463558832Z 59 PC: 135c8 | Change current directory
2018-12-17T21:57:36.470906759Z 59 PC: 135d3 | Change current directory
2018-12-17T21:57:36.47485635Z 25 PC: 12d13 | Get default drive
2018-12-17T21:57:36.476278601Z 37 PC: 127d3 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T21:57:36.47892742Z 37 PC: 127da | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T21:57:36.480459622Z 37 PC: 127e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T21:57:36.482836791Z 80 PC: 1301d | Set current PSP
2018-12-17T21:57:36.485973901Z 37 PC: 13041 | Set interrupt vector (Interrupt = '46' AKA 'Set verify flag')
2018-12-17T21:57:36.48756529Z 53 PC: 13362 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T21:57:36.488960775Z 37 PC: 13383 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T21:57:36.49137806Z 51 PC: 13417 | Get or set Ctrl-Break
2018-12-17T21:57:36.493468623Z 72 PC: 130ec | Allocate memory
2018-12-17T21:57:36.495361174Z 61 PC: 131b2 | Open file (Filename = '')
2018-12-17T21:57:36.501670968Z 62 PC: 131ba | Close file
2018-12-17T21:57:36.504220836Z 51 PC: 1344c | Get or set Ctrl-Break
2018-12-17T21:57:36.505609452Z 74 PC: 1197c | Reallocate memory
2018-12-17T21:57:36.507868818Z 72 PC: 11991 | Allocate memory
2018-12-17T21:57:36.509609454Z 73 PC: 119b2 | Release memory
2018-12-17T21:57:36.511254173Z 72 PC: 119bd | Allocate memory
2018-12-17T21:57:36.514119068Z 73 PC: 119df | Release memory
2018-12-17T21:57:36.515625284Z 72 PC: 119f5 | Allocate memory
2018-12-17T21:57:36.517546262Z 72 PC: 119fd | Allocate memory