Sample viewer

vx.netlux.org/Virus.DOS.Hellfire.1085

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:45:16.347626671Z 78 PC: 12a4c | Find first file
2018-12-17T22:45:16.352337929Z 61 PC: 12a56 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:45:16.356473678Z 63 PC: 12a61 | Read file or device (Read 1 bytes on handle 5)
2018-12-17T22:45:16.360709904Z 62 PC: 12a65 | Close file
2018-12-17T22:45:16.362519106Z 61 PC: 12a76 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:45:16.369690158Z 44 PC: 12a7b | Get time 0x12a7b: mov word ptr [0x537], dx
0x12a7f: mov ah, 0x40
0x12a81: push ax
0x12a82: mov cx, 0x43d
0x12a85: push cx
0x12a86: mov dx, 0x100
0x12a89: jmp 0x12e60
0x12a8c: mov ah, 9
0x12a8e: mov dx, 0x1d6
0x12a91: int 0x21
0x12a93: int 0x20
0x12a95: mov ah, 0xf
0x12a97: int 0x10
0x12a99: xor ah, ah
0x12a9b: int 0x10
0x12a9d: mov ah, 1
0x12a9f: mov cx, 0x2607
0x12aa2: int 0x10
0x12aa4: mov ax, 0xb800
0x12aa7: mov es, ax
2018-12-17T22:45:16.371428054Z 64 PC: 12e67 | Write file or device (Write 1085 bytes on handle 5)
2018-12-17T22:45:16.517902254Z 9 PC: 12a93 | Display string (String= 'Bad command or file name ')