Sample viewer

vx.netlux.org/Trojan.DOS.Erase26.d3

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:44:56.835059949Z 48 PC: 12a4c | Get DOS version
2018-12-17T22:44:56.837134219Z 53 PC: 12bef | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:44:56.839019723Z 53 PC: 12bfc | Get interrupt vector (Interrupt = '4' AKA 'Auxiliary output')
2018-12-17T22:44:56.840122371Z 53 PC: 12c09 | Get interrupt vector (Interrupt = '5' AKA 'Printer output')
2018-12-17T22:44:56.841146165Z 53 PC: 12c16 | Get interrupt vector (Interrupt = '6' AKA 'Direct console I/O')
2018-12-17T22:44:56.842748604Z 37 PC: 12c2a | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:44:56.844122922Z 74 PC: 12af4 | Reallocate memory
2018-12-17T22:44:56.846252018Z 68 PC: 12feb | I/O control for devices (Set for = 'pyright 1991 Borland Intl.')
2018-12-17T22:44:56.849581441Z 68 PC: 12feb | I/O control for devices (Set for = '')
2018-12-17T22:44:56.852477681Z 42 PC: 12e58 | Get date 0x12e58: mov word ptr [si], cx
0x12e5a: mov word ptr [si + 2], dx
0x12e5d: pop si
0x12e5e: pop bp
0x12e5f: ret
0x12e60: push bp
0x12e61: mov bp, sp
0x12e63: push si
0x12e64: mov si, word ptr [bp + 4]
0x12e67: mov ah, 0x2c
0x12e69: int 0x21
0x12e6b: mov word ptr [si], cx
0x12e6d: mov word ptr [si + 2], dx
0x12e70: pop si
0x12e71: pop bp
0x12e72: ret
0x12e73: push bp
0x12e74: mov bp, sp
0x12e76: push word ptr [bp + 4]
0x12e79: mov al, 0
2018-12-17T22:44:56.854920555Z 44 PC: 12e6b | Get time 0x12e6b: mov word ptr [si], cx
0x12e6d: mov word ptr [si + 2], dx
0x12e70: pop si
0x12e71: pop bp
0x12e72: ret
0x12e73: push bp
0x12e74: mov bp, sp
0x12e76: push word ptr [bp + 4]
0x12e79: mov al, 0
0x12e7b: push ax
0x12e7c: call 0x12e83
0x12e7f: pop cx
0x12e80: pop cx
0x12e81: pop bp
0x12e82: ret
0x12e83: push bp
0x12e84: mov bp, sp
0x12e86: push si
0x12e87: mov si, word ptr [bp + 6]
0x12e8a: push ds
2018-12-17T22:44:56.859724822Z 28 PC: 12e92 | Get allocation info for specified drive
2018-12-17T22:44:57.453649444Z 53 PC: 12ed1 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-17T22:44:57.455542655Z 37 PC: 12ee4 | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-17T22:44:57.457993251Z 73 PC: 12d92 | Release memory
2018-12-17T22:44:57.4598008Z 49 PC: 12d9c | Terminate and stay resident (Return code = '0' | Memory size = '4756')