Sample viewer

vx.netlux.org/Virus.DOS.HLLP.VVC.8304

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:46:11.209041275Z 53 PC: 13842 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:46:11.219408185Z 53 PC: 13842 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:46:11.220854893Z 53 PC: 13842 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:46:11.222289541Z 53 PC: 13842 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:46:11.224394575Z 53 PC: 13842 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:46:11.225726908Z 53 PC: 13842 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:11.227039544Z 53 PC: 13842 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:46:11.22859648Z 53 PC: 13842 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:46:11.231499374Z 53 PC: 13842 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:46:11.233864501Z 53 PC: 13842 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:46:11.236718359Z 53 PC: 13842 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:46:11.239318855Z 53 PC: 13842 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:46:11.241008726Z 53 PC: 13842 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:46:11.24301034Z 53 PC: 13842 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:46:11.246049986Z 53 PC: 13842 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:46:11.247995265Z 53 PC: 13842 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:46:11.249951481Z 53 PC: 13842 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:46:11.253469986Z 53 PC: 13842 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:46:11.254941773Z 53 PC: 13842 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:46:11.256402697Z 37 PC: 13857 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:46:11.25825323Z 37 PC: 1385f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:46:11.259411495Z 37 PC: 13867 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:11.260621983Z 37 PC: 1386f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:46:11.262572007Z 68 PC: 13e42 | I/O control for devices (Set for = '')
2018-12-17T22:46:11.280488498Z 42 PC: 134c7 | Get date 0x134c7: xor ah, ah
0x134c9: les di, ptr [bp + 6]
0x134cc: stosw word ptr es:[di], ax
0x134cd: mov al, dl
0x134cf: les di, ptr [bp + 0xa]
0x134d2: stosw word ptr es:[di], ax
0x134d3: mov al, dh
0x134d5: les di, ptr [bp + 0xe]
0x134d8: stosw word ptr es:[di], ax
0x134d9: xchg ax, cx
0x134da: les di, ptr [bp + 0x12]
0x134dd: stosw word ptr es:[di], ax
0x134de: pop bp
0x134df: retf 0x10
0x134e2: push bp
0x134e3: mov bp, sp
0x134e5: mov cx, word ptr [bp + 0xa]
0x134e8: mov dh, byte ptr [bp + 8]
0x134eb: mov dl, byte ptr [bp + 6]
0x134ee: mov ah, 0x2b
2018-12-17T22:46:11.284514926Z 64 PC: 13f45 | Write file or device (Write 2 bytes on handle 1)
2018-12-17T22:46:11.290010834Z 64 PC: 13f45 | Write file or device (Write 28 bytes on handle 1)
2018-12-17T22:46:11.297410582Z 64 PC: 13f45 | Write file or device (Write 35 bytes on handle 1)
2018-12-17T22:46:11.304643547Z 64 PC: 13f45 | Write file or device (Write 64 bytes on handle 1)
2018-12-17T22:46:11.311692864Z 64 PC: 13f45 | Write file or device (Write 38 bytes on handle 1)
2018-12-17T22:46:11.31821455Z 64 PC: 13f45 | Write file or device (Write 0 bytes on handle 1)
2018-12-17T22:46:11.320988094Z 37 PC: 13956 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:46:11.322307871Z 37 PC: 13956 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:46:11.324560116Z 37 PC: 13956 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:46:11.326652199Z 37 PC: 13956 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:46:11.327958299Z 37 PC: 13956 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:46:11.330127283Z 37 PC: 13956 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:11.331817877Z 37 PC: 13956 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:46:11.333402151Z 37 PC: 13956 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:46:11.335182823Z 37 PC: 13956 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:46:11.336620442Z 37 PC: 13956 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:46:11.337804421Z 37 PC: 13956 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:46:11.338947972Z 37 PC: 13956 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:46:11.340637811Z 37 PC: 13956 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:46:11.342105475Z 37 PC: 13956 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:46:11.343564338Z 37 PC: 13956 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:46:11.345382148Z 37 PC: 13956 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:46:11.346703707Z 37 PC: 13956 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:46:11.348111651Z 37 PC: 13956 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:46:11.350326273Z 37 PC: 13956 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:46:11.352063932Z 76 PC: 13995 | Terminate with return code (Return code = '0')