Sample viewer

vx.netlux.org/Virus.DOS.WpcBats.3161

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:46:44.139345718Z 48 PC: 12f6a | Get DOS version
2018-12-17T22:46:44.156806447Z 72 PC: 12f79 | Allocate memory
2018-12-17T22:46:44.159214342Z 74 PC: 12f8b | Reallocate memory
2018-12-17T22:46:44.161441814Z 74 PC: 12f9a | Reallocate memory
2018-12-17T22:46:44.163441126Z 72 PC: 12fb0 | Allocate memory
2018-12-17T22:46:44.167098034Z 53 PC: 9ee54 | Get interrupt vector (Interrupt = '22' AKA 'Create or truncate file')
2018-12-17T22:46:44.168758936Z 53 PC: 9ee60 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-17T22:46:44.170975838Z 37 PC: 9ee83 | Set interrupt vector (Interrupt = '22' AKA 'Create or truncate file')
2018-12-17T22:46:44.177452829Z 37 PC: 9ee8a | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-17T22:46:44.18031833Z 47 PC: 9f5ec | Get disk transfer address
2018-12-17T22:46:44.18200077Z 53 PC: 9f5ec | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:44.184670582Z 37 PC: 9f5ec | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:44.186174479Z 26 PC: 9f5ec | Set disk transfer address
2018-12-17T22:46:44.187563186Z 46 PC: 9f5ec | Set verify flag
2018-12-17T22:46:44.191598808Z 78 PC: 9f5ec | Find first file
2018-12-17T22:46:44.199171845Z 26 PC: 9f5ec | Set disk transfer address
2018-12-17T22:46:44.201201211Z 37 PC: 9f5ec | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:46:44.21315372Z 9 PC: 12ad3 | Display string (String= ' Mabuhay! This program came from Bahay Kawayan at http://come.to/hexfiles Putoksa Kawayan [email protected] ')
2018-12-17T22:46:44.228549599Z 76 PC: 12ad7 | Terminate with return code (Return code = '36')